Intel

CVE-2026-8037

Progress LoadMaster — Progress LoadMaster Command Injection Vulnerability

criticalKEV: actively exploitedPoCEPSS 100%

Description

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

Source: CISA_KEVNVDCVEORGBSIBSI_CSAFCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

With a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and an EPSS score at the 99.9th percentile, this vulnerability represents one of the highest-probability exploitation targets in the current threat landscape — virtually all other CVEs carry lower exploitation likelihood. The unauthenticated, network-accessible attack surface means no user interaction or prior foothold is required, and a successful exploit grants full OS control over an appliance that typically sits at a trusted boundary between the internet and internal services, enabling traffic interception, credential harvesting from TLS termination, and direct lateral movement into internal network segments. For NIS2-obligated organisations — particularly KRITIS operators and essential entities — LoadMaster is frequently a high-availability critical component whose compromise or disruption triggers mandatory incident reporting obligations under Article 23 of the NIS2 Directive within 24 hours of awareness. Although CISA has not set the known-ransomware-campaign flag for this CVE, the appliance's privileged network position makes it a high-value target for persistence and data exfiltration; all exposed instances should be patched or isolated within the first operational window.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch immediately: Affected versions are LoadMaster 7.2.54.18 and 7.2.55.0–7.2.63.2, Connection Manager for ObjectScale 7.2.63.2, ECS Connection Manager 7.2.63.2, and MoveIt WAF 7.2.63.2. Retrieve the fixed version and download link from the current Progress vendor advisory and deploy without delay.
  • Restrict management API access: If immediate patching is not feasible, lock down the LoadMaster management interface (API endpoints, typically TCP 443 and TCP 8443) via firewall ACLs to explicitly authorised management IP addresses only. Remove any direct internet exposure of the management plane.
  • Enumerate exposed appliances: Audit your asset inventory for all LoadMaster instances (on-premises and cloud) reachable from public IP space or DMZ segments. Prioritise patching by exposure level.
  • Review API access logs: Inspect the last 30 days of API access logs for unauthenticated requests to command endpoints (e.g. /access/, /loadmaster/) to determine whether exploitation has already occurred before applying the patch.
  • Rotate all administrative credentials: Rotate local admin accounts, API keys, and any LDAP bind credentials associated with affected appliances immediately — successful exploitation yields full OS-level control, meaning credentials must be treated as compromised.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Restrict management API ports (TCP 443, TCP 8443) to dedicated jump hosts or management VLANs via perimeter firewall rules and internal VLAN ACLs. No direct access from production or user VLANs.
  • WAF/IPS rule: Block inbound HTTP requests containing command injection metacharacters in URL paths and POST bodies targeting LoadMaster API endpoints. Suggested Snort/Suricata pattern: alert http any any -> $LOADMASTER_IP any (msg:"CVE-2026-8037 CMD Injection attempt"; content:"/access/"; http_uri; pcre:"/[;&| + "" + $(){}]/U"; sid:20260001; rev:1;)` — adjust API paths per the vendor advisory.
  • Disable unauthenticated API access: Where the product configuration permits, disable anonymous or unauthenticated access to the API layer and enforce named service accounts with MFA for all management operations.
  • Egress filtering: Restrict outbound connections from the LoadMaster appliance subnet to required destinations only (update servers, syslog, NTP). This limits reverse-shell callback and C2 communication following a successful exploit.
  • File integrity monitoring: Enable FIM on critical appliance system paths where the platform supports it, monitoring for unexpected changes to configuration files and binaries as an indicator of post-exploitation persistence.

Runbook · Step 3

Detection rules

  • Web access log analysis: Flag unauthenticated HTTP requests (missing or invalid session token / no Authorization header) to API endpoints containing shell metacharacters in the path or body — SPL: index=loadmaster_access status!=401 status!=403 uri_path="/access/*" | regex uri_query="[;&|$(){}\ + "" + ]"`.
  • Process anomaly on appliance (if syslog/auditd is forwarded): Alert on unexpected child processes spawned by the LoadMaster API service — e.g. sh, bash, curl, wget, python — auditd rule: -a always,exit -F arch=b64 -S execve -F ppid=<lm_api_pid> -k cve_2026_8037.
  • Network telemetry (Zeek/Suricata): Detect outbound connections from the LoadMaster subnet to unknown external IPs on unusual ports (e.g. TCP 4444, 1337, 8080) — Zeek notice on conn.log where orig_h is within the LoadMaster CIDR and resp_p is not in an approved whitelist.
  • Scanning/exploitation pattern correlation: Correlate a burst of HTTP 4xx responses from a single source IP (>20 errors within 60 seconds) followed by an HTTP 200 on a command endpoint — a strong indicator of successful exploitation after automated fuzzing.
  • Sysmon EID 3 (if Windows management host is in scope): Alert on network connections initiated by processes outside the expected management toolset to public IPs — KQL: SysmonEvent | where EventID == 3 and InitiatingProcessName !in~ ("expected_mgmt_processes") and DestinationIPType == "Public".

Metrics

Severity
critical
Priority score
238.96
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
9.8
Source: nvd-v3
CVSS v3
9.6
CVSS v4
—
EPSS percentile
99.9 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
99.6 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2026-08-07 00:00 UTC
CWE
CWE-77

Weakness classes (CWE)

  • CWE-77Class

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

    The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Modified Analysis2026-08-10 20:19 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:progress:connection_manager_for_objectscale:*:*:*:*:*:*:*:* versions up to (excluding) 7.2.63.2 *cpe:2.3:a:progress:ecs_connection_manager:*:*:*:*:*:*:*:* versions up to (excluding) 7.2.63.2 *cpe:2.3:o:progress:loadmaster:*:*:*:*:*:*:*:* versions up to (excluding) 7.2.54.18 *cpe:2.3:o:progress:loadmaster:*:*:*:*:*:*:*:* versions from (including) 7.2.55.0 up to (excluding) 7.2.63.2 → OR *cpe:2.3:a:progress:connection_manager_for_objectscale:*:*:*:*:*:*:*:* versions up to (excluding) 7.2.63.2 *cpe:2.3:a:progress:ecs_connection_manager:*:*:*:*:*:*:*:* versions up to (excluding) 7.2.63.2 *cpe:2.3:o:progress:loadmaster:*:*:*:*:*:*:*:* versions up to (excluding) 7.2.54.18 *cpe:2.3:o:progress:loadmaster:*:*:*:*:*:*:*:* versions from (including) 7.2.55.0 up to (excluding) 7.2.63.2 *cpe:2.3:a:progress:moveit_web_application_firewall:*:*:*:*:*:*:*:* versions up to (excluding) 7.2.63.2
  2. CVE Modified2026-08-08 05:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-8037","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technical… → {"id":"CVE-2026-8037","role":"CISA Coordinator","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImp…
  3. Modified Analysis2026-08-07 19:59 UTC· nvd@nist.gov
    • Reference Type: CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037 Types: US Government Resource
    • Reference Type: CISA-ADP: https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037 Types: Third Party Advisory
  4. CVE CISA KEV Update2026-08-07 19:00 UTC· 9119a7d8-5eab-497f-8521-727c672e3725
    • Date Added: 2026-08-07
    • Due Date: 2026-08-07
    • Required Action: 2026-08-07
    • Vulnerability Name: 2026-08-07
  5. CVE Modified2026-08-07 18:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • Reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037
    • Reference: https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037
    • SSVC: {"id":"CVE-2026-8037","role":"CISA Coordinator","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImp… → {"id":"CVE-2026-8037","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technical…

Affected operating systems

  • other

    progress / loadmaster

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • progress

    connection_manager_for_objectscale7.2.63.2

  • progress

    ecs_connection_manager7.2.63.2

  • progress

    moveit_web_application_firewall7.2.63.2

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked advisories

IDCVE-2026-8037