Progress LoadMaster Command Injection Vulnerability
TL;DR 📌
- OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
- Highest CVSS: 9.6 (Critical).
- Listed in CISA KEV (2026-08-07) — this is being exploited in the wild.
- Fixed in
7.2.54.18,7.2.63.2— upgrade to this release or later. - CVEs: CVE-2026-8037.
What it is
CVE-2026-8037 is an OS command injection vulnerability in the API of Progress LoadMaster (Progress ADC products). Multiple command endpoints in the API fail to sanitise input, allowing arbitrary commands to be executed on the appliance itself.
The CVSS vector (AV:A/AC:L/PR:N/UI:N) indicates the attack is reachable over the adjacent network rather than requiring local access, and needs no authentication and no user interaction. Given the “un-authenticated attacker” wording in the advisory, this sits on the management/API plane rather than requiring valid credentials.
Impact is rated critical (CVSS 9.6) with high confidentiality, integrity and availability impact, and the scope is changed — meaning the injected commands run in a context that can affect resources beyond the vulnerable component itself, consistent with arbitrary command execution on the underlying appliance OS.
CISA added this CVE to its Known Exploited Vulnerabilities catalogue on 2026-08-07, so it is known to be exploited.
What to do
- Patch to Progress LoadMaster 7.2.54.18 or 7.2.63.2, whichever matches your current release branch — these are the fixed versions listed by NVD.
- Because this is in CISA KEV, treat patching as urgent rather than routine; federal agencies have mandated remediation timelines under KEV, and the same urgency applies regardless of sector.
- Restrict network reachability to the LoadMaster API where possible — the attack vector is adjacent-network, so tightening access to the management interface reduces exposure while patching is scheduled.
- Review LoadMaster logs for command execution via API endpoints predating your patch date, since exploitation is already known to be occurring.
- Confirm which specific command endpoints are affected by consulting Progress’s own advisory text, as the endpoint names were not detailed here beyond “multiple command endpoints”.
For leadership 🧭
Executive summary. Progress LoadMaster load balancers can be taken over by an attacker who reaches the API from the adjacent network, with no login required, giving full control of the appliance. CISA has confirmed active exploitation, so this needs emergency patching now rather than at the next scheduled window.
Why it matters:
- The vulnerability sits in LoadMaster’s API command endpoints, which sit on the management/control plane of a device that typically fronts production traffic — compromise here can affect everything behind the load balancer.
- No authentication or user interaction is needed, and the CVSS scope is changed, meaning injected commands can reach beyond the vulnerable component into the underlying appliance OS.
- CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalogue on 2026-08-07, confirming it is being used in the wild, not just theoretical.
- Because the appliance is often positioned as a trusted network chokepoint, an attacker who gains command execution here can pivot to internal systems it fronts.
Now / Next / Later:
- Now: Identify every LoadMaster instance in your estate and restrict network access to its API/management interface to trusted hosts only, while patches are staged.
- Next: Upgrade to Progress LoadMaster 7.2.54.18 or 7.2.63.2, matching your current release branch, in an emergency change rather than the routine cycle given active exploitation.
- Later: Review logs for API command execution predating the patch date to check for prior compromise, and establish a standing rule that management-plane access to ADC/load-balancer APIs is never exposed beyond a locked-down admin network.