Progress LoadMaster Command Injection Vulnerability

🚨SEVERITY: CRITICAL — CVSS 9.6Security Advisory

TL;DR 📌

  • Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.
  • Highest CVSS: 9.6 (Critical).
  • Listed in CISA KEV (2026-08-07) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-8037.

What it is

CVE-2026-8037 is a command injection vulnerability in Progress LoadMaster, the vendor’s load balancer/ADC appliance. The flaw sits in multiple command endpoints where input is not properly sanitised before being passed through to the underlying system.

The attack vector is adjacent network (AV:A), meaning an attacker needs some form of network access to the appliance’s management interface rather than being reachable from anywhere on the internet, but no authentication or user interaction is required (PR:N, UI:N). Given that combination, anyone who can reach the relevant endpoint can inject commands directly.

The impact is a full compromise of confidentiality, integrity and availability on the appliance, with a scope change indicating the exploit can affect resources beyond the vulnerable component itself. This is consistent with arbitrary command execution on the LoadMaster host.

CVE-2026-8037 is listed in the CISA Known Exploited Vulnerabilities catalogue, added on 2026-08-07, so it is known to be exploited.

What to do

  • Treat this as urgent: CVSS 9.6, unauthenticated, no user interaction, and already in CISA KEV.
  • Consult the Progress advisory for LoadMaster for a fixed release — none is stated here, so check directly with the vendor before assuming a patch exists.
  • Restrict network access to the LoadMaster management interface immediately; do not expose it to untrusted networks while remediation is pending.
  • Review LoadMaster logs for signs of unexpected command execution or unusual activity on management endpoints.
  • Track the advisory for an updated fix, and apply it as soon as it is published given the KEV listing.

For leadership 🧭

Executive summary. Risk is Critical (CVSS 9.6) across any Progress kit you run. Follow the remediation in the vendor advisory within Immediate — CISA KEV entries carry a federal remediation deadline.

Why it matters:

  • Exposure depends on deployment topology and which access paths reach the affected component.
  • Treat internet-facing and management-plane instances as higher risk than internal-only ones.
  • Keep monitoring for abnormal authentication and configuration events until upgrades complete.

Now / Next / Later:

  • Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
  • Next: apply the remediation the advisory specifies, through an approved change window.
  • Later: add a control check so builds cannot drift back onto a vulnerable train.

Source