ZeroDay Findings
Sign inSign up

Findings

CVE-2026-8037

Progress LoadMaster Command Injection Vulnerability

Published Jun 4, 2026 · updated Oct 1, 2026 · Progress LoadMaster

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-8037.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 4, 2026 · Catalog

    Detected

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-8037.

  2. Aug 7, 2026 · CISA KEV

    Known exploited

    Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

  3. Aug 10, 2026 · CISA KEV

    Remediation due

    Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

  4. Oct 1, 2026 · Catalog

    Updated

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-8037.

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA due date Aug 10, 2026

Affected

  • cpe progress/connection manager for objectscaleversion unspecified
  • cpe progress/ecs connection managerversion unspecified
  • cpe progress/loadmasterversion unspecified
  • cpe progress/moveit web application firewallversion unspecified
  • vendor Progress LoadMasterversion unspecified

Sources

  • CISA KEVCVE-2026-8037

    Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.

    cisa.gov
  • CVE.orgCVE-2026-8037

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-8037

    30-day exploitation probability 77.4%

    first.org
  • NIST NVDCVE-2026-8037

    OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

    nvd.nist.gov
  • Zero Day InitiativeZDI-26-646

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-8037.

    zerodayinitiative.com

References