CVE-2026-8037: Progress LoadMaster API OS Command Injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable RCE with CVSS 9.8, KEV listing and near-maximum EPSS indicates imminent and active exploitation risk.

What it is

Progress LoadMaster (and related ADC products) contain an OS command injection flaw in multiple API command endpoints where unsanitized input is passed to the shell. An unauthenticated remote attacker can execute arbitrary commands on the appliance, making this a critical pre-auth RCE in an internet-facing load balancer.

Impact

An attacker gains arbitrary command execution on the LoadMaster appliance, allowing full compromise of the device, its configuration and any secrets or traffic it handles.

Attack surface

Reached over the network via the API command endpoints; the CVSS vector (AV:N/AC:L/PR:N/UI:N) and description confirm no authentication or user interaction is required.

Exploitation

Listed in CISA KEV with a 2026-08-10 remediation due date, and EPSS is 0.99571 (99.9th percentile); a public exploit write-up is referenced, indicating active exploitation.

What to do

• Apply the vendor patch from the Progress LoadMaster security bulletin immediately.
• If patching is not possible, restrict API access to trusted management networks and remove internet exposure per CISA BOD 26-04 guidance.
• Discontinue use of the product if mitigations are unavailable, as directed by CISA.
• Audit and rotate any credentials, certificates or secrets stored on or passing through affected appliances.
• Review the other products listed (Connection Manager for ObjectScale, ECS Connection Manager, MOVEit WAF) for the same exposure and patch status.

Detection

• Hunt for unexpected child processes spawned by the LoadMaster API/web service (e.g. shell, curl, wget, nc) on the appliance.
• Monitor API endpoint access logs for anomalous or malformed command parameters and requests from untrusted source IPs.
• Alert on outbound connections from the appliance to unknown hosts, which may indicate post-exploitation callbacks.
• Check for unauthorized configuration changes, new accounts or persistence artifacts on the appliance.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.