CVE-2025-13447
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster
- State
- Published
- Severity
- 8.4 High
- Published
- Jan 13, 2026
- Updated
- Feb 26, 2026
- Reserved
- Nov 19, 2025
Description
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.4 High | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | ProgressSoftware |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
LoadMasterProgress Software |
|
References
- https://community.progress.com/s/article/LoadMaster-Vulnerabilities-CVE-2025-13444-CVE-2025-13447vendor-advisory
- https://community.progress.com/s/article/ECS-Connection-Manager-Vulnerabilities-CVE-2025-13444-CVE-2025-13447vendor-advisory
- https://community.progress.com/s/article/Connection-Manager-for-ObjectScale-Vulnerabilities-CVE-2025-13444-CVE-2025-13447vendor-advisory
- https://community.progress.com/s/article/MOVEit-WAF-Vulnerabilities-CVE-2025-13444-CVE-2025-13447vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.