Critical RCE Flaw in Progress ADC LoadMaster Appliances

The National Vulnerability Database has detailed CVE-2026-3518, a high-severity OS command injection vulnerability impacting Progress ADC Products’ LoadMaster appliances. This flaw, rated CVSS 8.4, allows an authenticated attacker with ‘All’ permissions to execute arbitrary commands remotely. The exploit targets unsanitized input within the ‘killsession’ command, enabling a complete takeover of the affected device.

This vulnerability (CWE-77) is particularly concerning because it requires prior authentication and elevated privileges, suggesting a sophisticated attacker or an insider threat. However, the ease of exploitation once authenticated means that compromised credentials or privilege escalation on the appliance could lead to devastating remote code execution. Defenders must prioritize patching and review access controls for LoadMaster administrative interfaces.