CVE-2026-3519

CVE-2026-3519 is an OS command injection vulnerability in Progress ADC products' API that enables authenticated attackers with VS Administration privileges to execute arbitrary commands on LoadMaster appliances through unsanitized input in the 'aclcontrol' command. This vulnerability affects administrative-level users who can inject malicious commands to achieve remote code execution on the affected system. The vulnerability carries a HIGH severity rating with a CVSS score of 8.4, reflecting its significant risk. The attack requires adjacent network access and high-level administrative privileges, reducing opportunistic exploitation potential, but once exploited results in complete system compromise including confidentiality, integrity, and availability breaches. The attack is not complex to execute and requires no user interaction. Exploitation status indicates this vulnerability currently poses limited active threat. The EPSS score of 0.00162 shows extremely low probability of exploitation in the wild relative to other CVEs, the vulnerability is not included on the KEV catalog, and community attention remains inactive. However, the moderate FAUCET risk score of 50.0 suggests organizations should still prioritize patching, particularly those operating LoadMaster appliances in sensitive environments where administrative account compromise is plausible.