What’s Vulnerable › Vulnerabilities

CVE-2026-8037: Progress LoadMaster Command Injection Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-08-07
• EPSS: 99.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-04 · updated 2026-10-15
• Weakness: CWE-77

Description

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

Affected products

• Progress Connection Manager For Objectscale: before 7.2.63.2 — fixed in 7.2.63.2
• Progress Software ECS Connection Manager: before 7.2.63.2 — fixed in 7.2.63.2
• Progress Software LoadMaster: before 7.2.54.18; from 7.2.55.0 before 7.2.63.2 — fixed in 7.2.54.18, 7.2.63.2
• Progress Moveit Web Application Firewall: before 7.2.63.2 — fixed in 7.2.63.2

How to fix

Upgrade to a fixed version: Progress Connection Manager For Objectscale 7.2.63.2; Progress Software ECS Connection Manager 7.2.63.2; Progress Software LoadMaster 7.2.54.18, 7.2.63.2; Progress Moveit Web Application Firewall 7.2.63.2. Check the vendor advisory for mitigations.

In the news

• Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)

References

• https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691
• https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037
• https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037

Get alerted when CVE-2026-8037 or the next vulnerability affects your stack