Tony Vaughan (Progress Software) asked a question.
Release Date: 20 April 2026
Security Updates
Fix for CVE-2026-21876
Fixed an issue in the OWASP Core Rule Set that could occur when processing multipart requests with multiple parts, where malicious charsets in earlier parts can be missed if a later part has a legitimate charset. (LM-8555)
Fix for CVE-2026-3517
Fixed an issue that allowed an authenticated user to inject arbitrary OS commands through the API. (LM-8727)
Fix for CVE-2026-3518
Fixed an issue that allowed an authenticated user to inject arbitrary OS commands through the API. (LM-8604)
Fix for CVE-2026-3519
Fixed an issue that allowed an authenticated user to inject arbitrary OS commands through the API. (LM-8810)
Fix for CVE-2026-4048
Fixed an issue that allowed an authenticated user to cause a system reboot by uploading a carefully crafted custom Web Application Firewall (WAF) rule. (LM-8827)
Other Updates
Additional fixes not directly related to system security have also been included in this release. Please see the release notes for the details, at the link below.
Links
Connection Manager for ObjectScale Release Notes and Documentation
LoadMaster Security Vulnerabilites: CVE-2026-3517 / CVE-2026-3518 / CVE-2026-3519 / CVE-2026-4048 / CVE-2026-21876 states affected versions are GA v7.2.62.2 and older, so 7.2.63.0 is remediated as well? We are running 7.2.63.0.5b22875.RELEASE.20260311-1521.
Hello Dan
there is no additional security fixes that were added to 7.2.63.1
that are not on 7.2.63.0
however there is two issues on 7.2.63.0 that are resolved on 7.2.63.1
LM-8550: Edge Security Pack (ESP)/SAML and OIDC Authentication
LM-8872: Health check routing
I'd recommend checking these in the release notes to make sure they don't affect your production environment