# CVE-2026-3518: OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated…

Source: https://junglewise.ai/threats/cve-2026-3518-os-command-injection-remote-code-execution-vulnerability-in-api-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-20  
License: CC BY 4.0 with a link back

CVE-2026-3518 · Severity: high · CVSS 8.4 · Published 2026-04-20

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'killsession' command

Technologies: [Progress Connection Manager For Objectscale](https://junglewise.ai/threats/technologies/connection-manager-for-objectscale), [Progress Ecs Connection Manager](https://junglewise.ai/threats/technologies/ecs-connection-manager), [Progress LoadMaster](https://junglewise.ai/threats/technologies/loadmaster). Vendors: [Progress](https://junglewise.ai/threats/vendors/progress).

## Quick answers

**Is CVE-2026-3518 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3518 being exploited in the wild.

**How severe is CVE-2026-3518?** High severity, with a CVSS score of 8.4, published 20 April 2026.

**Which products and versions are affected?** Progress Connection Manager For Objectscale, Progress Ecs Connection Manager, Progress LoadMaster. The advisory does not name versions.

**Is there a fix for CVE-2026-3518?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-3518?** Check whether you run Progress Connection Manager For Objectscale, Progress Ecs Connection Manager or Progress LoadMaster. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Progress Connection Manager For Objectscale
- Progress Ecs Connection Manager
- Progress LoadMaster

## Related threats

- [Progress LoadMaster OS command injection in API](https://junglewise.ai/threats/cve-2026-8037-progress-loadmaster-os-command-injection-in-api)
- [OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated…](https://junglewise.ai/threats/cve-2026-4048-os-command-injection-remote-code-execution-vulnerability-in-ui-in)
- [OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated…](https://junglewise.ai/threats/cve-2026-3519-os-command-injection-remote-code-execution-vulnerability-in-api-in)
- [OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated…](https://junglewise.ai/threats/cve-2026-3517-os-command-injection-remote-code-execution-vulnerability-in-api-in)
- [Progress LoadMaster OS command injection in API](https://junglewise.ai/threats/cve-2025-13444-progress-loadmaster-os-command-injection-in-api)