CVE-2026-8037 — OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale…

Description (CNA)

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

Affected (CNA)

Vendor / product	Versions
Progress Software / LoadMaster	affected V7.2.60.0 before V7.2.63.2; affected V7.2.54.12 before V7.2.54.18
Progress Software / ECS Connections Manager	affected V7.2.60.0 before V7.2.63.2
Progress Software / Object Scale Connection Manager	affected V7.2.60.0 before V7.2.63.2
Progress Software / MOVEit WAF	affected V7.2.60.0 before V7.2.63.2

CWE

CWE-77

References

https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691

ADP enrichment

CISA-ADP

No English description supplied.

https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/
https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037