This vulnerability (CVE-2026-3518) affects Progress Software LoadMaster version 7.2.37.0 and involves OS command injection (CWE-77) in the API. An attacker with authenticated 'All' permissions can exploit unsanitized input in the 'killsession' command to execute arbitrary commands on the device. The CVSS 3.1 base score is 8.4, reflecting high impact on confidentiality, integrity, and availability. The attack vector is adjacent network, requiring low attack complexity and high privileges, with no user interaction needed. No known exploits in the wild or vendor patch information are currently available.

Successful exploitation allows an authenticated user with full permissions to execute arbitrary OS commands on the LoadMaster appliance, potentially leading to full compromise of the device, including confidentiality, integrity, and availability impacts. This could disrupt network services or allow further lateral movement within the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the LoadMaster API to trusted administrators only and monitor for suspicious activity involving the 'killsession' command. Avoid granting unnecessary 'All' permissions to users. Follow vendor updates closely for any forthcoming patches or mitigations.