Home / Vulnerability Intelligence / CVE-2026-3518

CVE-2026-3518 - Vulnerability Analysis

HighCVSS: 8.4

Last Updated: April 20, 2026

Progress ADC LoadMaster - Command Injection

Published: April 20, 2026Updated: April 20, 2026

Overview

Progress ADC LoadMaster contains a command injection caused by unsanitized input in the 'killsession' command, letting authenticated attackers with all permissions execute arbitrary OS commands remotely.

Severity & Score

Severity: High

CVSS Score: 8.4

EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Authenticated attackers with all permissions can execute arbitrary OS commands, potentially leading to full system compromise.

Mitigation

Update to the latest version of Progress ADC LoadMaster.

References

https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Apr 20, 2026

🟠 CVE-2026-3518 - High (8.4) OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the '... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3518/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Apr 20, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-3518
Severity: High
CVSS Score: 8.4
Type: command_injection
Status: unconfirmed
EPSS: 0.0%
Social Posts: 2

CWE

CWE-77

CVSS Metrics

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS Score

0.0%Probability of exploitation in the next 30 days