This vulnerability (CVE-2026-3519) in Progress Software LoadMaster (v7.2.45.0) involves OS command injection via the 'aclcontrol' command in the API. An authenticated attacker with 'VS Administration' privileges can supply unsanitized input that is executed by the system, enabling arbitrary command execution on the appliance. The CVSS 3.1 base score is 8.4, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). No patch or official remediation level has been disclosed by the vendor as of the published date.

Successful exploitation allows an attacker with elevated administrative privileges to execute arbitrary OS commands on the LoadMaster appliance. This can lead to complete system compromise, including unauthorized access to sensitive data, modification or destruction of system resources, and disruption of service availability. The high CVSS score (8.4) indicates severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict 'VS Administration' permissions to trusted users only and monitor for suspicious activity related to the 'aclcontrol' command. Avoid exposing the management interface to untrusted networks. Follow vendor communications closely for updates on patches or official mitigations.