cbcvebase.
CVE-2026-8037
published 2026-06-04

CVE-2026-8037: OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on…

PriorityP199critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-08-10
Exploited in the wild
EPSS
99.57%
99.9th percentile
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

Affected

10 ranges
VendorProductVersion rangeFixed in
progressconnection_manager_for_objectscale< 7.2.63.27.2.63.2
progressecs_connection_manager< 7.2.63.27.2.63.2
progressloadmaster< 7.2.54.187.2.54.18
progressloadmaster>= 7.2.55.0 < 7.2.63.27.2.63.2
progressmoveit_web_application_firewall< 7.2.63.27.2.63.2
progress_softwareecs_connections_manager>= V7.2.60.0 < V7.2.63.2V7.2.63.2
progress_softwareloadmaster>= V7.2.45.12 < V7.2.54.18V7.2.54.18
progress_softwareloadmaster>= V7.2.60.0 < V7.2.63.2V7.2.63.2
progress_softwaremoveit_waf>= V7.2.60.0 < V7.2.63.2V7.2.63.2
progress_softwareobject_scale_connection_manager>= V7.2.60.0 < V7.2.63.2V7.2.63.2

Detection & IOCsextracted from sources · hover to see the quote

url/accessv2
url/accessv2
commandPOST /accessv2 HTTP/1.1 Content-Type: application/json {"cmd": "getall", "apiuser": "''''", "apipass": "BBBBB", "g0": "AAAAAAAAAAAAAAAA'; cat /etc/passwd #", ...}
snort
Progress Kemp LoadMaster Commad Injection (CVE-2024-1212, CVE-2026-8037)
  • Monitor for unauthenticated POST requests to the /accessv2 endpoint containing JSON bodies with a large number of extra key-value pairs (e.g., g0–g60) alongside an 'apiuser' field containing multiple single quotes (e.g., "''''"). This is the heap-spray pattern used to trigger the out-of-bounds read into adjacent heap memory.
  • Alert on POST /accessv2 requests where the JSON body contains shell metacharacters such as single quotes and semicolons in non-standard fields (e.g., values matching pattern: AAAA...'; <command> #), indicative of command injection payload spraying.
  • Exploitation activity commenced on June 29, 2026, coinciding with the public release of the watchTowr Labs PoC. Treat any POST to /accessv2 from external IPs after this date with elevated suspicion, especially from the three known attacker IPs.
  • The exploit response contains 'root:x:0:0:' in the body (from /etc/passwd read) with Content-Type: text/json and HTTP 200. Use this as a detection matcher for successful exploitation confirmation in HTTP response logs.
  • The vulnerable function is escape_quotes(). Look for crash/error logs or anomalous heap behavior in LoadMaster process logs referencing this function, which may indicate exploitation attempts even if they fail.
  • Use the FOFA fingerprint query (body="Progress" && icon_hash=="-2107233094") to identify internet-exposed LoadMaster appliances that may be targeted.
  • ·The vulnerability only affects LoadMaster appliances with the API enabled. Appliances with the API disabled are not exploitable via this vector.
  • ·Observed exploitation attempts from the three known IPs all ended in failure with no post-compromise activity, but a public PoC is available and further attempts are expected.
  • ·Fixed versions are GA v7.2.63.2 and LTSF v7.2.54.18. Detection rules targeting the /accessv2 endpoint should be retired or adjusted after patching, but network-level blocking of the known attacker IPs remains advisable.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.6CRITICAL
cisa7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.