Progress Software has released an emergency fix for a highly critical vulnerability, affecting its LoadMaster and LoadMaster Multi-Tenant (MT) Hypervisor products. This vulnerability, tracked as CVE-2024-7591, has a maximum CVSS score of 10/10 since it enables unauthenticated attackers to conduct remote code execution (RCE) by exploiting an improper input validation flaw. The attack can be facilitated through a maliciously crafted HTTP request targeting the management interface of affected devices. Once successful, the attacker can gain control over vulnerable systems without needing authentication. The flaw affects all versions of LoadMaster up to 7.2.60.0 and MT Hypervisor up to 7.1.35.11, including Long-Term Support (LTS) and Long-Term Support with Feature (LTSF) branches. At this time, Progress has confirmed that no reports of active exploitation have been received. Security researcher Florian Grunow is credited with discovering the issue. To mitigate the risk, Progress released a patch that can be installed on any affected version. The fix works by sanitizing user inputs to prevent arbitrary command execution. However, the patch does not apply to the free version of LoadMaster, leaving it exposed to potential exploitation. Progress strongly advises all users to apply the patch immediately by navigating to the system’s configuration interface and following their recommended security hardening guidelines. Failing to address this flaw could leave critical infrastructure and network environments vulnerable to remote command injection attacks, posing a significant risk to organizations relying on these solutions for load balancing, traffic management, and application delivery. CTIX analysts urge all administrators of the affected devices to install the patch immediately to prevent exploitation.