PT-2026-33761 · Progress · Adc Loadmaster

Michael Argany · Published 2026-04-20 · Updated 2026-05-21 · CVE-2026-3517

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Progress ADC LoadMaster (affected versions not specified)

Description An OS command injection flaw in the API allows an authenticated attacker with Geo Administration permissions to execute arbitrary commands on the appliance. This is possible due to unsanitized input in the 'addcountry' command.

Recommendations Update to the latest version. As a temporary workaround, restrict access to the 'addcountry' command to minimize the risk of exploitation.

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-3517

ZDI-26-319

Affected Products

Adc Loadmaster

References · 9

• https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-319 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-3517 · Security Note
• https://t.me/cveNotify/161783 · Telegram Post
• https://t.me/cveNotify/161797 · Telegram Post
• https://twitter.com/AndreGironda/status/2046272657117851675 · Twitter Post
• https://t.me/cveNotify/161795 · Telegram Post
• https://twitter.com/NetSecIO/status/2046649319420309956 · Twitter Post
• https://t.me/cveNotify/161796 · Telegram Post