Vulnerabilitycritical
Progress Software fixes sneaky WAF bypass vulnerability (CVE-2026-21876)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-21876 | The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls | 5.3 | 17% | PoC | |
CVE-2026-3518+3 related CVEs | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute… | 7.2 | 20% |
From the original article
2 min read at helpnetsecurity.com
Progress Software has fixed a slew of high-severity vulnerabilities in MOVEit WAF and LoadMaster, including a flaw (CVE-2026-21876) that may allow attackers to bypass firewall detection. MOVEit WAF (web application firewall) is designed to protect Progress’s managed file transfer platform MOVEit Transfer from web-based attacks.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.