Progress LoadMaster OS Command Injection Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the Progress LoadMaster API. This issue allows authenticated attackers with 'Geo Administration' permissions to execute arbitrary commands on the LoadMaster appliance. The vulnerability arises from unsanitized input in the 'addcountry' command, which can be exploited by manipulating the command's data. This vulnerability affects Progress LoadMaster GA versions through 7.2.62.2 and LTSF versions through 7.2.54.16.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected LoadMaster appliance.

Remediation

Progress has developed a patch for this vulnerability, which will be distributed to customers on April 20, 2026. Customers on a current maintenance agreement can access the upgrade through the Progress Community LoadMaster Download Hub. Those not on a maintenance agreement should contact a Progress Sales Representative or their respective Partner.