LoadMaster Security Vulnerabilites: CVE-2026-3517 / CVE-2026-3518 / CVE-2026-3519 / CVE-2026-4048 / CVE-2026-21876

The Progress Kemp LoadMaster team recently confirmed a series of high vulnerabilities in Progress Kemp LoadMaster: GA v7.2.62.2 and older and LTSF v7.2.54.16 and older (CVE-2026-3517, CVE-2026-3518, CVE-2026-3519, CVE-2026-4048, CVE-2026-21876). We have addressed the issues and have developed and tested a patch that will be distributed to customers on 20 April 2026. Currently, we have not received any reports that this vulnerability has been exploited, and we are not aware of any direct operational impact to customers.

Apr 20, 2026
Knowledge

Title

URL Name

LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876

Article Number

000297903

Information

The following issues have been identified:

CVE-2026-3517 - Command Injection Remote Code Execution Vulnerability

OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input.

CVE-2026-3518 - Command Injection Remote Code Execution Vulnerability

OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input.

CVE-2026-3519 - Authenticated API OS Command Injection

OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input.

CVE-2026-4048 - Command Injection Remote Code Execution Vulnerability via Custom WAF rule

OS Command Injection Remote Code Execution Vulnerability in UI in Progress LoadMaster allows an authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in a custom WAF rule file during the file upload process.

CVE-2026-21876 - Multipart WAF Bypass Using Multiple Content-Type Parts

The OWASP CRS WAF rule set used on LoadMaster flags the use of non-standard character sets in HTTP multipart request headers. This is done to counter WAF evasion attempts. A bug in the rule logic that iterates over all multipart content type headers present in a request means that character set validation is only executed against the last multipart content type header observed. This vulnerability allows a specially crafted multipart request to contain an encoded malicious payload that will bypass WAF detection.

What are the symptom(s)? 

An authenticated attacker can execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized API inputs.

In addition, specially crafted HTTP multipart requests containing an encoded malicious payload can bypass WAF detection on the LoadMaster appliance.

Note that there are no known indicators of compromise at this time.

What are the impact(s)?

Affects: 

Progress Kemp LoadMaster: GA v7.2.62.2 and older
Progress Kemp LoadMaster: LTSF v7.2.54.16 and older

 
If you have any questions or concerns related to this issue, please log in to open a new Technical Support case. Technical Support is available to Progress Kemp LoadMaster customers under warranty and active maintenance. If your version is no longer supported as part of the Product Lifecyle Policy, you should upgrade to a supported and fixed version.
 
Issue 

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') - (CVE-2026-3517, CVE-2026-3518, CVE-2026-3519, CVE-2026-4048)

CWE-794: Incomplete Filtering of Multiple Instances of Special Elements – (CVE-2026-21876)

In Progress Kemp LoadMaster before LoadMaster GA v7.2.63.0 and LTSF v7.2.54.17, an authenticated attacker can execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized API inputs. In addition, specially crafted HTTP multipart requests containing an encoded malicious payload can bypass WAF detection on the LoadMaster appliance.

What action(s) do I need to take? 

 
Solution 
We have addressed the vulnerability, and the Progress Kemp LoadMaster team strongly recommends performing an upgrade to the latest version listed in the table below. 

For all customers on a current maintenance agreement, the upgrade can be accessed by logging into the Progress Community or by clicking on one of the links below. Customers that are not on a current maintenance agreement should contact a Progress Sales Representative or their respective Partner.
 
To confirm your current version of Progress Kemp LoadMaster, please log into the web UI and find the version string in the top-right corner or look at the console after booting the appliance to find version information.

Vulnerable Version	Fixed Version(s)	Documentation
Progress Kemp LoadMaster GA v7.2.62.2 and all prior versions	Progress Kemp LoadMaster v7.2.63.1	Link to documentation
Progress Kemp LoadMaster LTSF v7.2.54.16 and all prior versions	Progress Kemp LoadMaster LTSF v7.2.54.17
Progress ECS Connection Manager v7.2.62.2 and all prior versions	Progress ECS Connection Manager v7.2.63.1
Progress Connection Manager for ObjectScale v7.2.62.2 and all prior versions	Progress Connection Manager for ObjectScale v7.2.63.1

Additional Information 

To receive email notifications for Product and Security Updates like this, please log into the Progress Community Portal and sign up for our Progress Alert and Notification Service (PANS).

Please see our FAQ page regarding Frequently Asked Questions (FAQ) for Progress Alert Notifications (PANS).

Additional Information

Environment

Last Modified Date

4/20/2026 1:14 PM

Disclaimer

Defect Number