CVE-2026-8037 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-06-04

Added to CISA KEV: 2026-08-07 64 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review API/management access logs, look for anomalous command execution, unexpected outbound connections, new user accounts, and verify appliance file/system integrity.
Immediately patch to fixed versions: LoadMaster V7.2.63.2 (or V7.2.54.18 for the V7.2.45.x branch) and equivalent fixed builds for ECS Connections Manager, Object Scale Connection Manager, and MOVEit WAF per Progress advisory.
Restrict access to management and API interfaces to trusted internal networks/VPN only via firewall ACLs until patched; never expose the management/API plane to the internet.
Monitor for exploitation attempts against API command endpoints, deploy detection signatures, rotate any credentials/keys stored on affected appliances, and assume compromise if unpatched appliances were internet-reachable.
Patch priority: EMERGENCY / P0 — CISA KEV, unauthenticated RCE, public exploits, active exploitation.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-8037 is a critical OS command injection and remote code execution (RCE) vulnerability affecting the API components of various Progress software products, including LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and the MOVEit WAF. The vulnerability stems from the improper sanitization of user-supplied input across multiple command endpoints, which allows an unauthenticated, remote attacker to execute arbitrary system commands on the affected appliance. Because this flaw impacts core infrastructure components often deployed at the network edge, it presents a significant risk to organizations by potentially granting full administrative control over the compromised device ^[2]^[4].

Exploitation

Active Exploitation: The vulnerability is actively exploited in the wild and has been included in the CISA Known Exploited Vulnerabilities (KEV) catalog ^[1]^[3].
Availability of Exploits: Multiple proof-of-concept (PoC) and exploit tools are publicly available on platforms such as GitHub ^[2].
Attack Prerequisites: The attack is remote (network-based) and does not require authentication or user interaction. Exploitation is possible from any network segment that can reach the device’s management interface or exposed API endpoints ^[1].

Affected Products & Patches

Affected Products: Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF ^[1].
Patches: Users should consult Progress software support portals to identify the specific patched versions for their respective products. Organizations are strongly advised to apply updates immediately given the active exploitation status ^[3].
Mitigations: Restricting network access to management interfaces and vulnerable API endpoints via firewall rules or VPNs is recommended until patches can be deployed to reduce the attack surface.

Impact

Access/Capabilities: Successful exploitation grants an attacker the ability to execute arbitrary commands with the privileges of the underlying application, potentially leading to full system compromise.
Business Risk: For internet-facing deployments, the risk is severe; attackers can use these devices as initial entry points to move laterally within the internal network, intercept traffic, exfiltrate sensitive data, or deploy further malicious payloads throughout the enterprise environment ^[1]^[3].

Sources

CVE-2026-8037 - Vulnerability Details - OpenCVE
The vulnerability is listed in the CISA KEV catalog. The likely attack vector is an unauthenticated API call to vulnerable command endpoints reachable from any network segment that can contact the device’s management interface. Generated by OpenCVE AI on August 8, 2026 at 14:38 UTC. ... CVE-2026-803…
CVE-2026-8037 - Progress LoadMaster Command Injection...
CVE-2026-8037 has a 5 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.The following table lists the changes that have been made to the CVE-2026-8037 vulnerability over time. Vulnerability history details can be useful for understanding the evolution of a vulnera…
CISA Adds One Known Exploited Vulnerability to Catalog
This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding ...
NVD-CVE-2026-8037 - National Vulnerability Database
Description. OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to ...

🔴 CVE-2026-8037