CVE Watch25 de out. de 2026

CVE-2026-3517

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administ

CVSS

8.4

Alta

EPSS

15.5%

p97

KEV

—

Exploit Today

0-100

Publicado: 20 de abr. de 2026 · Última mod.: 25 de out. de 2026 · CWE-77

EPSS · 30d

3.0%EPSS · 30 dias15.5%

2026-10-142026-11-11

Descrição técnica

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'addcountry' command

Referências oficiais

community.progress.comhttps://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1261677.2 ALT

—

———A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.12h CVE-2026-960537.8 ALT

54.6%

——16Improper neutralization of special elements used in a command ('command injection') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.1d CVE-2026-839535.5 MÉD

57.9%

——17Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an authorized attacker to disclose information locally.1d CVE-2026-1233878.0 ALT

57.3%

——17Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privileges over a network.1d CVE-2026-1216628.6 ALT

45.1%

——14Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.2d CVE-2026-1199898.2 ALT

48.7%

——15Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.2d