← All Advisories

Progress LoadMaster's Command Injection Flaw Allows Unauthenticated Remote Attackers to Execute Arbitrary OS Commands on the Load Balancer Appliance; CISA's August 10th KEV Deadline Has Passed

Last refreshed2026-09-27

Status: KEV  |  Advisory ID: CVE-2026-8037

Key Details

CVECVE-2026-8037
Vulnerability NameProgress LoadMaster Command Injection Vulnerability
CVSS Score / Version9.6 (Critical) / CVSS v3.1
Updated2026-09-22
CVSS VectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS Proseattack vector is adjacent; attack complexity is low; privileges required is none; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected productsProgress LoadMaster, Progress Connection Manager for ObjectScale, Progress ECS Connection Manager, and Progress MOVEit Web Application Firewall
Exploitation statusListed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation.
Classified asCWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
KEV listingAdded to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-08-07.
Exploitation prediction (EPSS)77.36% probability of exploitation in the next 30 days (100% percentile) -- FIRST.org's EPSS model.
Federal remediation deadline2026-08-10 (CISA KEV, Binding Operational Directive).

Affected Products, Subsystems & Sectors

VendorProductAffected VersionsPatch Status
ProgressLoadMaster
ProgressConnection Manager for ObjectScale
ProgressECS Connection Manager
ProgressMOVEit Web Application Firewall
SubsystemsGeneral OT
SectorsMulti-sector

What to Know

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

What to Do

Monitor Progress's web page for any future patch releases.

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-8037
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-8037

KEV Required Action

FieldValue
KEV Linkhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog
Date Added to KEV2026-08-07
Required Action Due Date2026-08-10
Required ActionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

About

OT-Advisories  ·  CVE  ·  NVD  ·  CVSS  ·  KEV  ·  EPSS  ·  CWE