CVE WatchJul 13, 2026

CVE-2024-1212

Progress Kemp LoadMaster OS Command Injection Vulnerability

CVSS

10.0

Critical

EPSS

95.4%

p100

KEV

YES

Nov 18, 2024

Exploit Today

0-100

Published: Feb 21, 2024 · Last modified: Jul 13, 2026 · CWE-78

EPSS · 30d

95.4%EPSS · 30 days95.4%

2026-09-162026-10-14

KEV catalog record

Product

Progress / Kemp LoadMaster

Vulnerability

Progress Kemp LoadMaster OS Command Injection Vulnerability

Added to KEV

Nov 18, 2024

Remediate by

Dec 9, 2024

Known ransomware use

Summary description

Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://community.progress.com/s/article/Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212 ; https://nvd.nist.gov/vuln/detail/CVE-2024-1212

Technical description

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1109255.4 MED

—

———A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell.5h CVE-2026-1109088.8 HIG

—

———Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to execute as root. There are updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.8h CVE-2026-100232—

—

——0Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute arbitrary OS commands, resulting in remote code execution.14h CVE-2026-0320—

—

——0A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS management interface. The security risk posed by this issue is significantly minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by this vulnerability.14h CVE-2026-0313—

—

——0A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.14h CVE-2026-556796.5 MED

—

——0WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command executed by shell_exec(). The installer also writes attacker-controlled values into executable config.php and concatenates the database name nomebd into a CREATE DATABASE statement. Successful exploitation can execute commands as the web-server user, persist attacker-controlled PHP configuration, and alter or disrupt the application and its data. This issue is fixed in version 3.8.6.15h