Authenticated Command Injection in Progress ADC LoadMaster

The National Vulnerability Database has disclosed CVE-2026-4048, a critical OS command injection vulnerability affecting Progress ADC Products’ LoadMaster appliances. This flaw, rated CVSS 8.4, allows an authenticated attacker with ‘All’ permissions to execute arbitrary commands. The exploit targets unsanitized input within custom WAF rule files during the upload process, enabling remote code execution.

This vulnerability presents a significant risk for organizations relying on LoadMaster for traffic management and security. Attackers who gain administrative access, even with limited scope, could leverage this to gain deeper control over the appliance and potentially pivot to other network segments. The ease of exploitation once authenticated makes it a prime target for privilege escalation.

Defenders must prioritize patching or mitigating this vulnerability immediately. Reviewing access controls for administrative interfaces and scrutinizing WAF configurations for custom rule uploads are crucial steps. Any authenticated access to the LoadMaster appliance should be treated with suspicion, and logs should be monitored for signs of unauthorized file uploads or command execution.