The vulnerability is an OS command injection that allows an attacker to send unsanitized input to multiple command endpoints in the Progress ADC products. This flaw enables an unauthenticated attacker to execute arbitrary operating‑system commands on the LoadMaster appliance, leading to full compromise of the system and complete loss of confidentiality, integrity, and availability.

Affected vendors and products include Progress Software’s LoadMaster, ECS Connections Manager, Object Scale Connection Manager, and MOVEit WAF. No specific version numbers are provided in the advisory, so all current releases of these products are potentially impacted.

The CVSS score of 9.6 indicates a critical severity. The EPSS score of 2% indicates a very low but non-zero probability of exploitation, but given the remote code execution nature and absence from KEV, the risk remains high. Based on the description, the likely attack vector is an unauthenticated API call to the vulnerable command endpoints, which could be executed from any network segment that can reach the device’s management interface.