CVE-2026-8037: Progress LoadMaster Command Injection Vulnerability

EPSS trend

Probability

77.36%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

-22.21 pp

From 99.57% on 20-09-2026

20-09-202620-10-2026

EPSS score

77.36%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 07-08-2026
Federal due date: 10-08-2026

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. community.progress.com/s/… nvd.nist.gov/vuln/detail/CVE-2026-8037

Public exploits

1 found

referenceUnverified
Exploit Reference (labs.watchtowr.com)
Maturity: unknown

References

4 links

community.progress.com/s/…Vendor AdvisoryPatch
labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037Third Party AdvisoryExploitPatch
www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037Media CoverageThird Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037Government ResourceUS Government Resource

Related vulnerabilities

CVE-2025-13444progress softwareloadmaster+627.22%9mo ago13-01-2026 14:26OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters CVE-2025-13447progress softwareloadmaster+527.22%9mo ago13-01-2026 14:31OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters CVE-2024-2449progress softwareloadmaster+112.88%2y ago22-03-2024 13:35A cross-site request forgery vulnerability has been identified in LoadMaster. It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator.CVE-2024-2448progress softwareloadmaster+155.42%2y ago22-03-2024 13:32An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands into a UI component using a shell command resulting in OS command injection.CVE-2024-1212progress softwareloadmaster+1KEV95.39%2y ago21-02-2024 17:39Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.CVE-2026-59690progress softwareecs connection manager+90.26%2mo ago27-07-2026 12:26A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise.

All vulnerabilities inecs connections manager loadmaster moveit waf object scale connection manager connection_manager_for_objectscale

CVE-2026-8037: Progress LoadMaster Command Injection Vulnerability

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References