CVE-2026-4048

CVE-2026-4048 is an OS command injection vulnerability affecting Progress ADC LoadMaster appliances that permits authenticated users with elevated "All" permissions to execute arbitrary commands through unsanitized input in custom WAF rule file uploads. The vulnerability exists in the user interface and requires an attacker to have valid authentication credentials with administrative privileges. The vulnerability carries a CVSS score of 8.4 (HIGH) with an attack vector that is network-adjacent, low complexity, and high-impact across confidentiality, integrity, and availability. The requirement for high privilege administrative credentials and no user interaction significantly constrains the attack surface, though successful exploitation would grant complete system compromise. There is no current evidence of active exploitation in the wild. The vulnerability is not tracked on the CISA Known Exploited Vulnerabilities list, and community attention remains limited as indicated by its low EPSS score of 0.001620000. Organizations should prioritize patching but can evaluate this as a lower-urgency vulnerability given the current lack of exploitation activity and the authentication barrier required for attack.