Progress ADC RCE: Authenticated API Flaw Exposes LoadMaster

The National Vulnerability Database has disclosed CVE-2026-3519, a high-severity OS Command Injection vulnerability (CVSS 8.4) affecting Progress ADC products. This flaw resides in an API endpoint, specifically within the ‘aclcontrol’ command, due to unsanitized input.

An authenticated attacker with “VS Administration” permissions can exploit this vulnerability to execute arbitrary commands on the LoadMaster appliance. While requiring prior authentication and specific permissions, the impact is severe, allowing for full system compromise on affected devices. This is a direct path to persistent access and potentially lateral movement within an environment.

Defenders need to treat this with urgency. Given the administrative access required, this vulnerability is likely to be chained with other exploits, such as credential compromise, to gain the initial foothold. It underscores the critical importance of least privilege and robust authentication for network infrastructure components.