RCE in Progress Connection Manager For Objectscale*
CVE-2025-13447
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.272 (98.0th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.253 · newest: 0.272 · change: +0.020
Affected products
- Progress Connection Manager For Objectscale*
- Progress Ecs Connection Manager
- Progress Loadmaster
- Progress Moveit Waf — versions 7.2.62.1
- Progress Multi-Tenant Hypervisor
- Progress Software Loadmaster — versions 7.2.50, 7.1.32, 7.2.37
Weakness classification (CWE)
References
- community.progress.com/s/article/LoadMaster-Vulnerabilities-CVE-2025-13444-CVE-… (vendor-advisory, Vendor Advisory)
- community.progress.com/s/article/ECS-Connection-Manager-Vulnerabilities-CVE-202… (vendor-advisory, Vendor Advisory)
- community.progress.com/s/article/Connection-Manager-for-ObjectScale-Vulnerabili… (vendor-advisory, Vendor Advisory)
- community.progress.com/s/article/MOVEit-WAF-Vulnerabilities-CVE-2025-13444-CVE-… (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-13447?
- CVE-2025-13447 is a high-severity vulnerability in Progress Connection Manager For Objectscale*, classified under OS Command Injection. CVSS score: 8.4/10. Published 2026-01-13.
- How severe is CVE-2025-13447?
- High severity. CVSS v3 base score is 8.4 out of 10.