Loading story…
Progress disclosed two high-severity OS command injection vulnerabilities in its ADC product line, including LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF. The issues, tracked as CVE-2026-3517 and CVE-2026-3519, affect the API and can lead to remote code execution when authenticated administrators submit unsanitized input to specific commands. Both flaws are classified as CWE-77 and carry a CVSS v3.1 vector of AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating high impact across confidentiality, integrity, and availability.
CVE-2026-3517 allows an attacker with Geo Administration permissions to exploit the addcountry command, while CVE-2026-3519 requires VS Administration permissions to abuse the aclcontrol command. In both cases, Progress said arbitrary commands could be executed through the vulnerable API, and the vendor published an advisory covering these and related CVEs. Organizations using affected appliances should prioritize reviewing administrative access and applying vendor guidance to reduce exposure to authenticated abuse paths.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Progress Software disclosed and patched CVE-2026-21876, a high-severity WAF bypass in the OWASP Core Rule Set that could let unauthenticated attackers evade detection with a crafted multipart HTTP request. The company said MOVEit Cloud was already updated, urged customers to upgrade affected products, and noted it was not aware of active exploitation.
Progress published a security advisory covering CVE-2026-3519 along with several related vulnerabilities in its ADC products. The reference indicates public disclosure of the issue by April 20, 2026.
Progress received vulnerability reports on April 20, 2026 for two OS command injection flaws affecting its ADC products, specifically the LoadMaster appliance API. CVE-2026-3517 involves the 'addcountry' command and requires Geo Administration permissions, while CVE-2026-3519 involves the 'aclcontrol' command and requires VS Administration permissions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Progress Software disclosed and patched serious vulnerabilities in **Kemp LoadMaster** that could let attackers compromise load balancers deployed at the core of enterprise networks. The most prominent issue, tracked as **`CVE-2026-8037`**, was described in public advisories as affecting API methods including `dodelapikey` and `dolistapikeys`, where improper handling of memory could allow remote code execution after authentication, in some cases with **root** or administrator-level impact. Separate reporting also characterized `CVE-2026-8037` as a critical API command-injection issue that could permit arbitrary command execution and full administrative control of the appliance. Progress released updates to address the flaws, including patched firmware versions **`v7.2.63.2`** and **`v7.2.54.18`**, and said the fixes also apply to **ECS Connection Manager** and **Connection Manager for ObjectScale**. A second vulnerability, **`CVE-2026-33691`**, affects the **OWASP CRS** handling of multipart requests by failing to normalize whitespace in filenames, creating a path to bypass firewall extension checks. Security researchers credited in the disclosures include **Syed Ibrahim Ahmed** and **Jacky Yang** of TrendAI Research, and defenders were urged to patch quickly because compromise of internet-facing load balancers could provide a foothold for deeper intrusion into enterprise environments.
Jul 2, 2026
Progress Software disclosed two critical vulnerabilities in **MOVEit Automation**, including **CVE-2026-4670**, an improper authentication flaw that can allow authentication bypass over the network without user interaction. The issue is rated critical with CVSS `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating potential for high-impact compromise of confidentiality, integrity, and availability. Progress linked the flaw to **CWE-305** and included it in a security bulletin covering both **CVE-2026-4670** and **CVE-2026-5174**. The advisories affect multiple MOVEit Automation release branches, including versions prior to **2025.0.9**, **2024.1.8**, and releases before **2024.0.0**, with broader vendor and government guidance also referencing affected builds such as **2025.1.4 and earlier**, **2025.0.8 and earlier**, **2024.1.7 and earlier**, and **2024.0.0 and earlier**. The Canadian Centre for Cyber Security urged organizations to review the Progress bulletin and apply the required updates to mitigate exposure in internet-reachable file transfer automation environments.
Jun 29, 2026
Progress Software released security updates for multiple products, including **Progress LoadMaster**, **Sitefinity CMS**, and **Sitefinity Insight**, warning that the vulnerabilities could expose sensitive information, let attackers modify other users' account properties, or enable arbitrary code execution. The most severe issues disclosed were **`CVE-2026-7312`**, an insufficiently protected credentials flaw in Sitefinity web services rated **CVSS 10.0**, and **`CVE-2026-8037`**, a **CVSS 9.6** command-injection vulnerability in Progress LoadMaster. Technical analysis published after the advisory showed that **`CVE-2026-8037`** is a **pre-authentication remote code execution** flaw in **Kemp LoadMaster** when its API is enabled, affecting **GA `v7.2.63.1` and earlier** and **LTSF `v7.2.54.17` and earlier**. Researchers said the bug stems from an uninitialized heap buffer and missing null terminator in the `escape_quotes()` function used by the `/accessv2` endpoint, allowing attacker-controlled input to be incorporated into a shell command executed via `system()`. Progress patched the issue in **`v7.2.63.2`** by replacing `malloc()` with `calloc()` and adding explicit string termination, and defenders were urged to apply updates as soon as testing is complete.
Jul 10, 2026