CVE-2026-3517

CVE-2026-3517 is an OS command injection vulnerability affecting Progress ADC (Application Delivery Controller) products, specifically the LoadMaster appliance. The flaw exists in the API's 'addcountry' command, which fails to properly sanitize user input, allowing authenticated attackers with "Geo Administration" permissions to execute arbitrary commands with system-level privileges. The vulnerability carries a CVSS score of 8.4 (HIGH) with an adjacent network attack vector and high complexity requirements. Exploitation requires high-level administrative privileges and delivers complete compromise across confidentiality, integrity, and availability of the affected system and potentially connected infrastructure due to its capability to change scope. The vulnerability currently shows no evidence of active exploitation in the wild, with no known public exploit code available and no inclusion on the Known Exploited Vulnerabilities (KEV) catalog. Community attention remains minimal, reflected in the EPSS score of 0.0016, indicating this vulnerability ranks lower than 99.6 percent of known CVEs in terms of current exploitation likelihood.