CVE-2025-13444
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administr
CVSS
8.4
Alta
EPSS
27.2%
p98
KEV
—
Exploit Today
29
0-100
Publicado: 13 de jan. de 2026 · Última mod.: 10 de ago. de 2026 · CWE-78
27.2%EPSS · 30 dias27.2%
2026-10-122026-11-10
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters
- community.progress.comhttps://community.progress.com/s/article/Connection-Manager-for-ObjectScale-Vulnerabilities-CVE-2025-13444-CVE-2025-13447
- community.progress.comhttps://community.progress.com/s/article/ECS-Connection-Manager-Vulnerabilities-CVE-2025-13444-CVE-2025-13447
- community.progress.comhttps://community.progress.com/s/article/LoadMaster-Vulnerabilities-CVE-2025-13444-CVE-2025-13447
- community.progress.comhttps://community.progress.com/s/article/MOVEit-WAF-Vulnerabilities-CVE-2025-13444-CVE-2025-13447
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1229888.0 ALT—
——0Improper authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.4hCVE-2026-1199067.8 ALT—
——0Improper neutralization of special elements used in an os command ('os command injection') in Windows Sandbox allows an authorized attacker to elevate privileges locally.4hCVE-2026-1094578.0 ALT—
——0Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network.4hCVE-2026-1022248.4 ALT—
——0Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.4hCVE-2026-1260427.0 ALT—
——0VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a note whose filename or text includes shell metacharacters such as $(...), backticks, ; or |, executing commands as the victim when they run a task referencing these variables.6hCVE-2026-1054257.2 ALT—
——0OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.5h