CVE-2026-8037

CRITICALCVSS 9.6Known Exploited

CISA Known Exploited Vulnerability

https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-8037

Remediation deadline: August 10, 2026

Description

Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.

Timeline

Published:June 4th, 2026 2:16 PM

Last modified:August 10th, 2026 8:19 PM

Added to KEV:August 7th, 2026

CVSS Scoring

CVSS v3: 9.6 (CRITICAL)

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Software

From NVD CPE configuration data

Vendors

progress

Products

connection_manager_for_objectscaleecs_connection_managermoveit_web_application_firewallloadmaster