CVE-2026-3518

VULNERABILITY OVERVIEW CVE-2026-3518 is an OS command injection remote code execution vulnerability affecting Progress ADC (Application Delivery Controller) LoadMaster appliances. The flaw exists in the API's 'killsession' command, which fails to properly sanitize user input, allowing authenticated attackers with elevated "All" permissions to execute arbitrary commands on the affected appliance. SEVERITY ASSESSMENT The vulnerability carries a CVSS score of 8.4 (HIGH) with an adjacent network attack vector, low complexity, and high privilege requirements. However, the impact is severe, enabling complete compromise of confidentiality, integrity, and availability across connected systems due to the vulnerability's scope change characteristic. The FAUCET Risk Score of 50.0 out of 100 indicates moderate organizational risk. EXPLOITATION STATUS Currently, this vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and remains on the inactive Hot List, suggesting no evidence of active exploitation in the wild. The extremely low EPSS score of 0.0016 indicates minimal probability of exploitation, though the high privilege requirement may limit real-world attack surface. Organizations should nonetheless prioritize patching to eliminate this critical remote code execution vector.