Progress ADC Products Face Critical OS Command Injection RCE

The National Vulnerability Database has detailed CVE-2026-3517, a high-severity OS command injection vulnerability impacting Progress ADC Products. This flaw, rated 8.4 CVSS, allows an authenticated attacker with “Geo Administration” permissions to achieve remote code execution (RCE) on the LoadMaster appliance. The root cause lies in unsanitized input within the ‘addcountry’ command’s API.

This isn’t just another bug; it’s a critical RCE that, while requiring authentication and specific permissions, provides a direct path to appliance compromise. Attackers who gain administrative access, even lower-tier ‘Geo Administration’ privileges, can leverage this to execute arbitrary commands. This escalates a potentially contained compromise into full system control.

Defenders need to treat this with urgency. Organizations utilizing Progress ADC LoadMaster appliances must identify if they are running affected versions. The attacker’s calculus here is straightforward: gain initial access, then exploit this vulnerability for full control. Patching or implementing robust input validation and strict access controls for administrative interfaces are paramount to mitigate this risk.