Progress Kemp LoadMaster Multiple High-Severity Vulnerabilities (CVE-2026-3517/3518/3519/4048/21876) and Patch Guide

Vulnerability Overview Progress Kemp LoadMaster has confirmed a series of high-severity vulnerabilities, including: CVE-2026-3517: Command injection remote code execution vulnerability CVE-2026-3518: Command injection remote code execution vulnerability CVE-2026-3519: Authentication API command injection remote code execution vulnerability CVE-2026-4048: Command injection remote code execution vulnerability CVE-2026-21876: Multipart WAF bypass vulnerability These vulnerabilities allow attackers to execute arbitrary commands by exploiting unvalidated API inputs. Impact Scope Progress Kemp LoadMaster GA v7.2.6.2 and earlier versions Progress Kemp LoadMaster LTSF v7.2.5.16 and earlier versions Remediation The Progress Kemp LoadMaster team strongly recommends upgrading to the following versions: Progress Kemp LoadMaster GA v7.2.6.3 Progress Kemp LoadMaster LTSF v7.2.5.17 For all customers under an active maintenance agreement, upgrades can be performed by logging into Progress Community or contacting a Progress Sales Representative or partner. Additional Information Issue 77: Improper neutralization of special elements used in a command (command injection) Issue 794: Incomplete filtering of multiple instances of special elements Environment Last Modified Date: April 20, 2026, 1:14 PM Disclaimer The information on this site may be provided internally or externally by Progress Software Corporation. Progress Software Corporation makes reasonable efforts to ensure the accuracy of the information but does not guarantee its accuracy. Sample code is provided “as is,” without any express or implied warranties. Privacy Policy The website uses cookies to improve user experience, including personalizing content, analyzing website traffic, etc. Users can manage cookie settings by clicking “Accept and Close,” “Reject All,” or “Change Settings.” Related Links Progress Community Product Downloads Product Forums Contact Information Technical Support: Log in to open a new technical support case. Sales: Contact a Progress Sales Representative or partner. Other FAQ: Frequently asked questions about Progress Alert Notifications (PANS). Terms of Use: Terms of use. Privacy Center: Privacy center. Trademark: Trademark. License Agreements: License agreements. Careers: Careers. Offices: Offices. Privacy Settings DO NOT SELL MY PERSONAL INFO: Do not sell my personal information. Files Files (0): No files. Summary Progress Kemp LoadMaster has multiple high-severity vulnerabilities; it is recommended to upgrade to the specified versions as soon as possible to remediate these issues.

Goal Reached Thanks to every supporter — we hit 100%!

Progress Kemp LoadMaster Multiple High-Severity Vulnerabilities (CVE-2026-3517/3518/3519/4048/21876) and Patch Guide