vuln.management
Act nowKnown exploited

Advisory · CVE-2026-8037

Progress LoadMaster command injection is in CISA KEV

CISA says an unauthenticated attacker can execute arbitrary commands through unsanitized input in multiple LoadMaster command endpoints.

Advisory published June 2026Independent summary
Vendor
Progress
Product
LoadMaster
Identifier / CWE
CVE-2026-8037
CWE-77
Action timing
Aug 10, 2026
ELI5

Explain it like I’m five

A public-facing box takes words from a stranger and accidentally treats them like instructions. Instead of only reading the request, it can run the stranger's commands on the appliance.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted request

    An unauthenticated attacker sends malicious input to a command endpoint.

  2. 02Input is not cleaned

    LoadMaster passes attacker-controlled text into a command context.

  3. 03Command executes

    The appliance runs an operating-system command chosen by the attacker.

  4. 04Appliance at risk

    Configuration, credentials, and traffic-handling trust may be exposed.

What happened

CISA added CVE-2026-8037 to the Known Exploited Vulnerabilities catalog on August 7, 2026. CISA describes an unauthenticated command-injection weakness caused by unsanitized input in multiple command endpoints on Progress LoadMaster appliances.

An exposed or otherwise reachable management surface should be treated as urgent. Known exploitation changes this from a theoretical patching decision into an incident-triage question.

What to do

  1. Inventory LoadMaster appliances, including standby and disaster-recovery instances.
  2. Identify management interfaces reachable from the internet or untrusted networks.
  3. Follow the Progress bulletin for affected versions, updates, and mitigations.
  4. Preserve relevant appliance and network logs before they rotate.
  5. Review available evidence for unexpected command activity or configuration changes.
  6. If compromise is suspected, follow your incident-response process and rotate credentials or secrets accessible from the appliance.
  7. Verify the running version and exposure after remediation; do not close solely on a change ticket.

Management note

CISA lists August 10, 2026 as the required-action date for agencies covered by its directive. Other organizations can use that deadline as a strong prioritization signal, but should base their response on actual inventory, exposure, and evidence of compromise.

This summary does not replace the vendor bulletin. Validate affected versions and remediation instructions against Progress before making changes.