This vulnerability (CVE-2026-3517) in Progress Software LoadMaster 7.1.32.0 involves OS command injection (CWE-77) in the API's 'addcountry' command. An attacker with authenticated access and 'Geo Administration' permissions can supply unsanitized input to execute arbitrary operating system commands on the appliance. The CVSS 3.1 vector (AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects that the attack requires network access with high privileges but no user interaction, and successful exploitation can lead to complete compromise of confidentiality, integrity, and availability of the device. The vendor has not yet published a patch or official remediation instructions. This vulnerability is not related to a cloud service and no known active exploitation has been reported.

Successful exploitation allows an authenticated user with elevated 'Geo Administration' privileges to execute arbitrary OS commands on the LoadMaster appliance. This can lead to full compromise of the device, including unauthorized disclosure, modification, or destruction of data and disruption of service. The vulnerability affects confidentiality, integrity, and availability at a high level as indicated by the CVSS score of 8.4.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict 'Geo Administration' permissions to trusted users only and monitor for suspicious activity related to the 'addcountry' API command. No vendor-provided temporary fixes or workarounds are currently available.