PT-2026-2443 · Progress · Progress Loadmaster

Alex Williams · Published 2026-01-13 · Updated 2026-02-09 · CVE-2025-13447

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Progress LoadMaster (affected versions not specified)

Description An authenticated attacker with “User Administration” permissions can execute arbitrary commands on the LoadMaster appliance. This is due to unsanitized input in the API input parameters, leading to an OS Command Injection Remote Code Execution. The issue affects the API functionality of the software.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-13447

ZDI-26-051

ZDI-26-053

ZDI-26-054

ZDI-26-055

Affected Products

Progress Loadmaster

References · 13

• https://community.progress.com/s/article/ECS-Connection-Manager-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-13447 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-053 · Security Note
• https://community.progress.com/s/article/LoadMaster-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 · Vendor Advisory
• https://community.progress.com/s/article/Connection-Manager-for-ObjectScale-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-054 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-26-055 · Security Note
• https://community.progress.com/s/article/MOVEit-WAF-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-051 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-13447 · Security Note
• https://twitter.com/TheHackerWire/status/2011105942935683441 · Twitter Post
• https://twitter.com/CVEnew/status/2011096086983917678 · Twitter Post
• https://twitter.com/ET_Labs/status/2020975418057294288 · Twitter Post