CVE-2026-8037

OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

Affected

Progress Software · LoadMaster · ECS Connections Manager · Object Scale Connection Manager · MOVEit WAF

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 PROGRESS

9.6 CRITICALCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

77.36% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2026-08-07

Nuclei

critical

Published

2026-06-04

Updated

2026-10-15

Proof-of-concept exploits (2)

• HORKimhab/CVE-2026-80370★ · 2026-06-30
• Caster-chen/CVE-2026-8037-POC0★ · 2026-07-09

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8037.yaml

Security advisories

• https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-…
• https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitia…
• https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targe…

References

• CVE Record
• NVD entry