CVE-2026-8037
published 2026-06-04CVE-2026-8037: OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on…
PriorityP199critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-08-10
Exploited in the wild
EPSS
99.57%
99.9th percentile
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| progress | connection_manager_for_objectscale | < 7.2.63.2 | 7.2.63.2 |
| progress | ecs_connection_manager | < 7.2.63.2 | 7.2.63.2 |
| progress | loadmaster | < 7.2.54.18 | 7.2.54.18 |
| progress | loadmaster | >= 7.2.55.0 < 7.2.63.2 | 7.2.63.2 |
| progress | moveit_web_application_firewall | < 7.2.63.2 | 7.2.63.2 |
| progress_software | ecs_connections_manager | >= V7.2.60.0 < V7.2.63.2 | V7.2.63.2 |
| progress_software | loadmaster | >= V7.2.45.12 < V7.2.54.18 | V7.2.54.18 |
| progress_software | loadmaster | >= V7.2.60.0 < V7.2.63.2 | V7.2.63.2 |
| progress_software | moveit_waf | >= V7.2.60.0 < V7.2.63.2 | V7.2.63.2 |
| progress_software | object_scale_connection_manager | >= V7.2.60.0 < V7.2.63.2 | V7.2.63.2 |
Detection & IOCsextracted from sources · hover to see the quote
commandPOST /accessv2 HTTP/1.1
Content-Type: application/json
{"cmd": "getall", "apiuser": "''''", "apipass": "BBBBB", "g0": "AAAAAAAAAAAAAAAA'; cat /etc/passwd #", ...}↗
snort↗
Progress Kemp LoadMaster Commad Injection (CVE-2024-1212, CVE-2026-8037)
- →Monitor for unauthenticated POST requests to the /accessv2 endpoint containing JSON bodies with a large number of extra key-value pairs (e.g., g0–g60) alongside an 'apiuser' field containing multiple single quotes (e.g., "''''"). This is the heap-spray pattern used to trigger the out-of-bounds read into adjacent heap memory. ↗
- →Alert on POST /accessv2 requests where the JSON body contains shell metacharacters such as single quotes and semicolons in non-standard fields (e.g., values matching pattern: AAAA...'; <command> #), indicative of command injection payload spraying. ↗
- →Exploitation activity commenced on June 29, 2026, coinciding with the public release of the watchTowr Labs PoC. Treat any POST to /accessv2 from external IPs after this date with elevated suspicion, especially from the three known attacker IPs. ↗
- →The exploit response contains 'root:x:0:0:' in the body (from /etc/passwd read) with Content-Type: text/json and HTTP 200. Use this as a detection matcher for successful exploitation confirmation in HTTP response logs. ↗
- →The vulnerable function is escape_quotes(). Look for crash/error logs or anomalous heap behavior in LoadMaster process logs referencing this function, which may indicate exploitation attempts even if they fail. ↗
- →Use the FOFA fingerprint query (body="Progress" && icon_hash=="-2107233094") to identify internet-exposed LoadMaster appliances that may be targeted. ↗
- ·The vulnerability only affects LoadMaster appliances with the API enabled. Appliances with the API disabled are not exploitable via this vector. ↗
- ·Observed exploitation attempts from the three known IPs all ended in failure with no post-compromise activity, but a public PoC is available and further attempts are expected. ↗
- ·Fixed versions are GA v7.2.63.2 and LTSF v7.2.54.18. Detection rules targeting the /accessv2 endpoint should be retired or adjusted after patching, but network-level blocking of the known attacker IPs remains advisable. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.6CRITICAL
cisa7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Progress LoadMaster API command injection
vuldb·2026-06-04·CVSS 9.6
CVE-2026-8037 [CRITICAL] Progress LoadMaster API command injection
A vulnerability was found in Progress LoadMaster, ECS Connections Manager, Object Scale Connection Manager and MOVEit WAF. It has been classified as critical. The impacted element is an unknown function of the component API. Performing a manipulation results in command injection.
This vulnerability is identified as CVE-2026-8037. The attack can only be performed from the local network. There is not any exploit available.
Upgrading the affected component is recommended.
GHSA
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting uns
ghsa_unreviewed·2026-06-04
CVE-2026-8037 [CRITICAL] CWE-77 OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting uns
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
VulnCheck
Progress loadmaster Improper Neutralization of Special Elements used in a Command ('Command Injection')
vulncheck·2026·CVSS 9.6
CVE-2026-8037 [CRITICAL] Progress loadmaster Improper Neutralization of Special Elements used in a Command ('Command Injection')
Progress loadmaster Improper Neutralization of Special Elements used in a Command ('Command Injection')
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
Affected: Progress loadmaster
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://kevintel.com/CVE-2026-8037
CISA
Progress LoadMaster Command Injection Vulnerability
cisa·2026-08-07·CVSS 7.5
CVE-2026-8037 [HIGH] CWE-77 Progress LoadMaster Command Injection Vulnerability
Vulnerability: Progress LoadMaster Command Injection Vulnerability
Affected: Progress LoadMaster
Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to B
No detection rules found.
Nuclei
Progress ADC LoadMaster - Command Injection
nuclei·CVSS 7.5
CVE-2026-8037 [HIGH] Progress ADC LoadMaster - Command Injection
Progress ADC LoadMaster - Command Injection
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
Template:
id: CVE-2026-8037
info:
name: Progress ADC LoadMaster - Command Injection
author: watchtowr,DhiyaneshDk
severity: critical
description: |
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
impact: |
Unauthenticated attackers can execute arbitrary commands on the LoadMaster appliance, potentially leadin
Hackernews
Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts
blogs_hackernews·2026-08-08·CVSS 9.8
CVE-2026-8037 [CRITICAL] Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical-severity security flaw impacting Progress Kemp LoadMaster to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild.
The vulnerability, tracked as CVE-2026-8037 (CVSS score: 9.6), is a command injection flaw that could be weaponized to achieve arbitrary code execution on susceptible devices.
"Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute a
Hackernews
⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More
blogs_hackernews·2026-07-06
CVE-2026-48276 ⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More
A streaming box should not need a threat model. Neither should a username field, a demo repo, a reset flow, or a browser permission prompt. That is the irritating part this week: the risky pieces were ordinary.
Home devices became a routing cover. Clean code pulled dirt from a dependency. Identity shortcuts aged badly. AI systems trusted the wrong instructions. Same soft spot throughout: trust placed one layer too early.
Below is the full recap, since this is apparently what counted as a normal week.
## ⚡ Threat of the Week
Net
Checkpoint
6th July – Threat Intelligence Report
blogs_checkpoint·2026-07-06
CVE-2026-46817 6th July – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 6th July – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 6th July, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
River Bank & Trust, a US financial institution, has experienced a ransomware incident after an unauthorized actor accessed the network of parent company River Financial Corporation on June 16. The bank found ransomware on portions of its server environment and is assessing whether personal data was accessed or exfiltrated.
Indra
Hackernews
Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts
blogs_hackernews·2026-07-01·CVSS 9.6
CVE-2026-8037 [CRITICAL] Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts
A recently disclosed critical security flaw impacting Progress Kemp LoadMaster is seeing active exploitation attempts, according to an advisory from eSentire's Threat Response Unit (TRU).
The Canadian cybersecurity company said it identified exploitation attempts targeting CVE-2026-8037 (CVSS score: 9.6), an operating system (OS) command injection flaw that could be exploited to achieve arbitrary code execution on susceptible devices. The exploitation activity commenced on June 29, 2026.
"OS Command Injection Remote Code Execution Vulnerability in
Hackernews
Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth
blogs_hackernews·2026-06-30·CVSS 9.6
CVE-2026-8037 [CRITICAL] Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth
A critical vulnerability in Progress Kemp LoadMaster can let an unauthenticated attacker execute arbitrary commands as root on the appliance by sending a crafted request to its API.
The flaw, tracked as CVE-2026-8037 , carries a CVSS score of 9.8 according to ZDI . A patch is available. If you run LoadMaster with the API enabled, update now.
Progress published its advisory on June 4 and says it has not received any reports of exploitation. On June 29, researchers at watchTowr Labs published a detailed technical write-up that walks through the full
https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037
2026-06-04
Published
2026-08-07
Added to CISA KEV
Exploited in the wild