CVE-2026-4048
Published: 20 April 2026
Summary
CVE-2026-4048 is a high-severity Command Injection (CWE-77) vulnerability in Progress Loadmaster. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-4048 is an OS Command Injection vulnerability that enables Remote Code Execution in the user interface of Progress ADC Products, specifically the LoadMaster appliance. The flaw stems from unsanitized input in a custom Web Application Firewall (WAF) rule file during the file upload process, as documented under CWE-77. Published on 2026-04-20, it carries a CVSS v3.1 base score of 8.4 (AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
An authenticated attacker possessing “All” permissions can exploit this vulnerability over an adjacent network with low attack complexity and no user interaction required. Successful exploitation allows the attacker to execute arbitrary operating system commands on the LoadMaster appliance, potentially compromising confidentiality, integrity, and availability due to the changed scope.
Mitigation details are available in the Progress community security advisory covering CVE-2026-4048 alongside related vulnerabilities: https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23859
Vulnerability details
OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in a custom WAF rule file during the…
more
file upload process.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in the web UI of the LoadMaster appliance enables exploitation of a network-accessible application for RCE (T1190) and direct arbitrary command execution via Unix shell (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted inputs like custom WAF rule files to prevent OS command injection during upload.
Mandates timely identification, reporting, and remediation of flaws such as this command injection vulnerability through patching.
Enforces least privilege to restrict 'All' permissions required for accessing the vulnerable UI file upload feature.