Description
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Progress Software LoadMaster
Default version status: unaffected
V7.2.60.0 to < V7.2.63.2affectedV7.2.54.12 to < V7.2.54.18affected
Progress Software ECS Connections Manager
Default version status: unaffected
V7.2.60.0 to < V7.2.63.2affected
Progress Software Object Scale Connection Manager
Default version status: unaffected
V7.2.60.0 to < V7.2.63.2affected
Progress Software MOVEit WAF
Default version status: unaffected
V7.2.60.0 to < V7.2.63.2affected
References
- https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691 ↗
- https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/ ↗
- https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037 ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037 ↗