CVE-2026-8037KEV · OVERDUECWE-77command-injection

Progress LoadMaster Command Injection Vulnerability

Critical · published June 4, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.6. It is confirmed in active exploitation. It sits in the 99.6th percentile for exploit probability.

74
days past CISA
deadline
CVSS v3.1
9.6
EPSS
77%
Percentile
99.6
In the wild
Confirmed
What it is

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.77362 · 99.6th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-06-04T18:16Z
KEV added
2026-08-07 · due 2026-08-10
Affected products (5)
ProductVersionsFixed in
progress/connection_manager_for_objectscale< 7.2.63.27.2.63.2
progress/ecs_connection_manager< 7.2.63.27.2.63.2
progress/moveit_web_application_firewall< 7.2.63.27.2.63.2
progress/loadmaster< 7.2.54.187.2.54.18
progress/loadmaster≥ 7.2.55.0, < 7.2.63.27.2.63.2
References (4)
https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691 · [email protected]https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/ · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved 100% → 77%
    epss
  • 04 JUN 13:13Z
    OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
    cvelistv5