The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical command injection vulnerability in Progress LoadMaster, tracked as CVE-2026-8037, to its Known Exploited Vulnerabilities (KEV) catalog after confirming evidence of active exploitation.
This vulnerability allows unauthenticated attackers to execute arbitrary commands on vulnerable appliances, posing a significant risk to organizations that expose LoadMaster management services to the internet.
CISA added the vulnerability to the KEV catalog on August 7, 2026, and instructed Federal Civilian Executive Branch agencies to implement vendor mitigations by August 10, as mandated by Binding Operational Directive 26-04.
The agency also urges defenders to evaluate their exposure to the internet, adhere to forensic triage requirements, and cease using the products when suitable mitigations are unavailable.
Progress LoadMaster Command Injection Vulnerability
CVE-2026-8037 is classified as CWE-77, which refers to the improper neutralization of special elements used in an operating system command.
The issue arises in API endpoints within Progress ADC products, including LoadMaster, where unsanitized input can be used to execute operating-system commands. Consequently, an attacker does not need valid appliance credentials to exploit this vulnerability.
ESentire has assigned the vulnerability a CVSS score of 9.6. Technical analysis indicates that the root cause is linked to the escape_quotes() function, in which a heap buffer is allocated, but the escaped strings are not properly null-terminated.
This oversight can result in out-of-bounds reads, allowing attacker-controlled content to be executed in a shell command through `system()`.
Researchers have identified that the vulnerable workflow can be accessed via the /accessv2 endpoint when the LoadMaster API is enabled.
If successfully exploited, this vulnerability can provide remote command execution on a device typically positioned at the network perimeter, making it an attractive target for reconnaissance, credential theft, lateral movement, or deployment of follow-on payloads.
eSentire’s Threat Response Unit reported a rise in exploitation attempts starting June 29, coinciding with the release of functional proof-of-concept code.
Although the company observed no successful compromises in monitored environments or post-compromise behavior, the availability of publicly available exploit code significantly lowers the barrier to opportunistic scanning and weaponization.
CISA’s addition to the KEV catalog indicates that exploitation has progressed beyond a theoretical risk. Currently, the catalog does not identify this vulnerability as being utilized in ransomware campaigns.
However, defenders should not interpret this as a sign of safety: externally reachable edge appliances can be valuable targets for initial access, especially when exploitation does not require authentication.
Required Defensive Actions
Organizations using Progress LoadMaster should take immediate steps to mitigate the risk:
- Identify all LoadMaster instances, particularly those with internet-accessible management interfaces or enabled APIs.
- Apply Progress’s security updates and mitigations as outlined in the vendor’s advisory.
- Restrict administrative and API access to trusted management networks, VPNs, or approved source IP ranges while patches are in progress.
- Review logs for web activity, API usage, authentication attempts, command execution, and configuration changes for any suspicious activity related to /accessv2.
- Investigate for unexpected accounts, scheduled tasks, outbound connections, or altered virtual-service configurations, as well as management-plane changes after remediation.
Patching alone may not eliminate attacker persistence, as CVE-2026-8037 allows unauthenticated command execution. Therefore, patching should be accompanied by a thorough assessment of any potential compromises.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
