PT-2026-2442 · Progress · Progress Loadmaster

Alex Williams · Published 2026-01-13 · Updated 2026-02-02 · CVE-2025-13444

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Progress LoadMaster (affected versions not specified)

Description An authenticated attacker with “User Administration” permissions can execute arbitrary commands on the LoadMaster appliance. This is due to unsanitized input in the API input parameters, leading to an OS Command Injection Remote Code Execution. The issue affects the API functionality of the software.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-13444

ZDI-26-052

Affected Products

Progress Loadmaster

References · 9

• https://community.progress.com/s/article/ECS-Connection-Manager-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-052 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13444 · Vendor Advisory
• https://community.progress.com/s/article/MOVEit-WAF-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 · Vendor Advisory
• https://community.progress.com/s/article/LoadMaster-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 · Vendor Advisory
• https://community.progress.com/s/article/Connection-Manager-for-ObjectScale-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13444 · Security Note
• https://twitter.com/CVEnew/status/2011089097121505558 · Twitter Post
• https://twitter.com/TheHackerWire/status/2011106161416957966 · Twitter Post