Search CVEs, research… / diras.sa
  • CISA KEV
  • EXPLOITED
  • PoC PUBLIC
  • PATCH AVAILABLE

CVE-2026-8037: pre-auth remote code execution in Progress LoadMaster

An unauthenticated attacker can execute arbitrary OS commands on Progress LoadMaster appliances, allowing full system compromise (CVE-2026-8037). The flaw is a command injection in API endpoints that accept unsanitized input. Affected LoadMaster builds include V7.2.60.0 up to but not including V7.2.63.2 and V7.2.45.12 up to but not including V7.2.54.18; related components (ECS Connections Manager, Object Scale Connection Manager, MOVEit WAF) share the same affected ranges. The vulnerability requires only network access to a vulnerable appliance and no authentication or user interaction.

Published Updated Source: CVE Program, NVD, CISA KEV, FIRST EPSS, Vendor advisory

CVSS 3.1
9.8CRITICAL
EPSS
0.77362
CWE
CWE-77
KEV DUE DATE
PATCH
Available

DIRAS TAKE

Urgent: CISA placed this CVE on its Known Exploited Vulnerabilities list with a federal remediation deadline of 2026-08-10, indicating immediate patching or mitigation is required for exposed systems.

What is CVE-2026-8037?

An unauthenticated attacker can execute arbitrary OS commands on Progress LoadMaster appliances, allowing full system compromise (CVE-2026-8037). The flaw is a command injection in API endpoints that accept unsanitized input. Affected LoadMaster builds include V7.2.60.0 up to but not including V7.2.63.2 and V7.2.45.12 up to but not including V7.2.54.18; related components (ECS Connections Manager, Object Scale Connection Manager, MOVEit WAF) share the same affected ranges. The vulnerability requires only network access to a vulnerable appliance and no authentication or user interaction. The weakness is classified as CWE-77 (Command Injection).

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Which versions of Progress LoadMaster are affected?

BRANCHAFFECTEDFIXED
LoadMasterV7.2.60.0 – before V7.2.63.2V7.2.63.2
LoadMasterV7.2.45.12 – before V7.2.54.18V7.2.54.18
ECS Connections ManagerV7.2.60.0 – before V7.2.63.2V7.2.63.2
Object Scale Connection ManagerV7.2.60.0 – before V7.2.63.2V7.2.63.2
MOVEit WAFV7.2.60.0 – before V7.2.63.2V7.2.63.2

Is CVE-2026-8037 being exploited?

CISA added CVE-2026-8037 to the Known Exploited Vulnerabilities catalog on 2026-08-07, and U.S. federal agencies must remediate by 2026-08-10; public exploit code is also available.

How to fix CVE-2026-8037

  1. Apply vendor updates to fixed releases: upgrade to V7.2.63.2 or V7.2.54.18 depending on your installed branch.
  2. If you cannot update immediately, restrict network exposure of LoadMaster management/API interfaces to trusted hosts and management networks.
  3. Follow the vendor’s mitigation guidance and monitor appliance logs and network traffic for suspicious command execution or unexpected processes.
  4. Treat internet-facing instances as high priority for patching in accordance with BOD 26-04 guidance.

Frequently asked questions

Is CVE-2026-8037 being actively exploited?

CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalog on 2026-08-07, and U.S. federal agencies were required to remediate by 2026-08-10; public exploit code is also available.

Which LoadMaster versions are affected by CVE-2026-8037?

LoadMaster builds V7.2.60.0 through before V7.2.63.2 and V7.2.45.12 through before V7.2.54.18 are listed as affected, as are the same ranges for ECS Connections Manager, Object Scale Connection Manager, and MOVEit WAF.

Is there a patch for CVE-2026-8037?

Yes. Progress published fixes; the vulnerability is corrected in V7.2.63.2 and V7.2.54.18 depending on the affected branch.

Does CVE-2026-8037 require authentication?

No. The vulnerability allows unauthenticated command execution against vulnerable LoadMaster API endpoints and requires only network access to the service.

References