The vulnerability is an OS command injection flaw in the user interface of Progress ADC products that allows an authenticated attacker with full administrative rights to upload a malicious custom WAF rule file and execute arbitrary commands on the LoadMaster appliance. Because the input is not sanitized, the attacker can run any system command, leading to complete compromise of confidentiality, integrity, and availability.

The flaw affects the Progress Software products LoadMaster, ECS Connections Manager, MOVEit WAF, and Object Scale Connection Manager. Specific affected versions are not listed in the advisory, so any deployment of these products may be susceptible until patched.

The CVSS score of 8.4 classifies this as high severity. The exploit requires an attacker to authenticate with an account that has All permissions and to use the web UI to upload a crafted WAF rule file, so the attack vector is remote over a network connection to the management interface. The EPSS score of 2% indicates a moderate likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog; the potential for remote code execution makes it a high risk for systems that expose the admin interface to exposed networks or have privileged accounts that lack proper segregation.