Ghostwire

CVE-2026-4048: OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker...

HIGH CVSS 7.5 Exploit Available 1 PoC

Published: April 20, 2026 | Last Modified: April 20, 2026

Description

OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in a custom WAF rule file during the file upload process.

Ghostwire Analysis — What This Means Practically

High CVSS score indicates significant risk — exploitation could lead to substantial data exposure or system compromise.
1 proof-of-concept exploit available on GitHub. Public exploit code lowers the barrier for both researchers and attackers.
15 articles from independent security sources have covered this vulnerability, indicating significant industry attention.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

Proof-of-Concept Exploits (1)

Astaruf/CVE-2026-40487

CVE-2026-4048: OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker...

Description

Ghostwire Analysis — What This Means Practically

Proof-of-Concept Exploits (1)

Security Coverage (15 articles)

References