CVE-2026-8037
Progress LoadMaster Command Injection Vulnerability
Description
CVE-2026-8037 is a critical OS command injection vulnerability in Progress ADC products — most notably the LoadMaster appliance — that allows an unauthenticated attacker to execute arbitrary commands by exploiting unsanitized input in multiple API command endpoints. Because the affected LoadMaster is a network application delivery controller, a successful command injection gives the attacker remote code execution on the appliance with the potential to pivot deeper into the network. The flaw requires no authentication and no user interaction, and its impact extends beyond the vulnerable component, earning it a CVSS 3.1 score of 9.6. With an EPSS score of over 99% and confirmed inclusion in CISA's Known Exploited Vulnerabilities catalog, CVE-2026-8037 is among the most urgent command injection vulnerabilities to remediate.
KEV Information
CVSS Score
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| progress | connection manager for objectscale | < 7.2.63.2 |
| progress | ecs connection manager | < 7.2.63.2 |
| progress | moveit web application firewall | < 7.2.63.2 |
| progress | loadmaster | < 7.2.54.18; >= 7.2.55.0, < 7.2.63.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691(Patch, Vendor Advisory)
- https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/(Exploit, Patch, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037(US Government Resource)
- https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037(Third Party Advisory)
Weakness Type
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Command injection occurs when software builds a command from externally influenced input without neutralizing special elements that can modify the command when it executes. In CVE-2026-8037, unsanitized input reaching multiple LoadMaster API command endpoints is passed into system command execution, letting an unauthenticated attacker run arbitrary commands on the appliance.
Learn more: CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection')
Impact Analysis
The impact of CVE-2026-8037 is severe: with an attack vector of adjacent network, exploitation requires the attacker to be on the same logical network segment as the appliance rather than the open internet, but with low attack complexity it is easy to trigger once that access exists. No privileges and no user interaction are required, so an unauthenticated attacker on the adjacent network can exploit it directly. Because the scope is changed, a successful exploit can affect resources beyond the vulnerable component, and the high impact to confidentiality, integrity, and availability means the attacker can read sensitive traffic and configuration, alter the appliance, and disrupt the services it fronts. Rated CVSS 9.6 (Critical) with an EPSS score above 99% (99th percentile) and active exploitation confirmed by CISA, this vulnerability has a near-certain likelihood of being exploited and demands immediate remediation.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-8037 by adding it to the Known Exploited Vulnerabilities catalog, so defenders should treat exposed Progress ADC appliances as under active attack. Public exploit and technical detail are available via watchTowr Labs' analysis, "Enterprise Tech, in "Shell" Out — Progress Kemp LoadMaster: uninitialized heap to pre-auth RCE (CVE-2026-8037)", which is tagged as an exploit reference. The EPSS score above 99% (99th percentile) indicates near-certain exploitation activity, and eSentire has published a security advisory noting this vulnerability is being targeted. Although the KEV ransomware flag is currently "Unknown," the combination of public exploit detail, pre-authentication reach, and a top-tier EPSS ranking makes immediate patching essential.
Remediation
- Apply the Progress fix immediately. Following CISA's KEV required action, apply mitigations per the vendor's LoadMaster Critical Security Bulletin and comply with BOD 26-04 guidance; if a fix cannot be applied, discontinue use of the affected appliance.
- Upgrade to a patched firmware version. Update LoadMaster to at least 7.2.54.18 (for the 7.2.54.x line) or 7.2.63.2 (for the 7.2.55.0 and later line), and update Connection Manager for ObjectScale, ECS Connection Manager, and MOVEit Web Application Firewall to 7.2.63.2 or later.
- Restrict management and API access by limiting the appliance's administrative and API endpoints to trusted management networks only, using network segmentation to remove adjacent-network reachability from untrusted hosts.
- Apply input validation and command safety at the perimeter where possible — for example, WAF rules that block command-injection metacharacters targeting the affected API endpoints — as an interim mitigation aligned with CWE-77 guidance.
- Review logs for indicators of compromise, including unexpected API command requests, unusual outbound connections from the appliance, and unauthorized configuration changes, and treat any compromised appliance as fully untrusted.
Technical Details
CVE-2026-8037 is an OS command injection (CWE-77) in the API of Progress ADC products, where user-controllable input reaching multiple command endpoints is incorporated into system commands without proper neutralization. Because commands and data are not strictly separated, an attacker can inject shell metacharacters that cause the underlying system to execute arbitrary commands with the privileges of the vulnerable service. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H shows the flaw is reachable from an adjacent network with low complexity and no authentication or user interaction, while the changed scope reflects that compromise of the appliance can extend to the broader environment it protects. A third-party technical write-up characterizes the issue as an uninitialized-heap-to-pre-auth-RCE chain on the LoadMaster, underscoring that the endpoints are reachable before authentication.
Frequently Asked Questions
Is CVE-2026-8037 being actively exploited?
Yes. CISA has added CVE-2026-8037 to its Known Exploited Vulnerabilities catalog, confirming active exploitation, and eSentire reports the vulnerability is being targeted. Its EPSS score above 99% (99th percentile) indicates near-certain exploitation activity, and public exploit detail is available.
What products are affected by CVE-2026-8037?
The vulnerability affects Progress ADC products, including LoadMaster (versions before 7.2.54.18, and 7.2.55.0 up to but not including 7.2.63.2), as well as Connection Manager for ObjectScale, ECS Connection Manager, and MOVEit Web Application Firewall in versions before 7.2.63.2.
How do I fix CVE-2026-8037?
Upgrade to a patched firmware version — LoadMaster 7.2.54.18 or 7.2.63.2, and 7.2.63.2 for the other ADC products — following the Progress Critical Security Bulletin and CISA's KEV guidance under BOD 26-04. Until patched, restrict adjacent-network access to the appliance's API and management endpoints and monitor logs for suspicious command activity.
How severe is CVE-2026-8037?
It is Critical, with a CVSS 3.1 base score of 9.6. The vulnerability is unauthenticated, exploitable from an adjacent network with low complexity, requires no user interaction, has a changed scope, and causes high confidentiality, integrity, and availability impact; combined with an EPSS score above 99%, it is one of the highest-priority vulnerabilities to remediate.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.