This vulnerability (CVE-2026-3519) in Progress Software LoadMaster version 7.2.45.0 involves OS command injection via the API's 'aclcontrol' command. An attacker with authenticated 'VS Administration' privileges can supply unsanitized input to this command, enabling arbitrary command execution on the appliance. The CVSS 3.1 vector (AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects that the attack requires network access with high privileges but no user interaction, and successful exploitation leads to complete compromise of confidentiality, integrity, and availability of the device. The vulnerability is categorized under CWE-77 (Improper Neutralization of Special Elements used in a Command). No official patch or remediation level has been published by the vendor as of the provided data.

Successful exploitation allows an authenticated user with elevated 'VS Administration' permissions to execute arbitrary OS commands on the LoadMaster appliance. This can lead to full compromise of the device, including unauthorized disclosure, modification, or destruction of data, and disruption of service. The vulnerability impacts the confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported, but the high CVSS score indicates a serious risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict 'VS Administration' permissions to trusted administrators only and monitor for suspicious activity related to the 'aclcontrol' command. Avoid exposing the management interface to untrusted networks to reduce attack surface.