A flaw allowing an authenticated attacker with VS Administration permissions to supply unsanitized input to the 'aclcontrol' command in the API of several Progress ADC products leads to OS command injection (CWE‑77). The injected payload is executed directly on the appliance’s operating system, giving the attacker full remote code execution capabilities. This can compromise confidentiality, integrity, and availability by enabling arbitrary command execution, potential data exfiltration, and denial of service against the appliance.

Affected vendor and product families are Progress Software ECS Connections Manager, Progress Software LoadMaster, Progress Software MOVEit WAF, and Progress Software Object Scale Connection Manager. No specific product versions were listed in the advisory; all current deployments of these products should verify whether they contain the patch for CVE‑2026‑3519.

The CVSS score of 8.4 indicates high severity. Exploitation requires authentication with VS Administration rights, which limits the attack surface to users with that privilege level. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Despite the lack of public exploit information, the impact of remote code execution remains substantial for any system that exposes the vulnerable API.