CVE-2026-8037

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-8037 9.6

Progress · LoadMaster · Added 2026-08-07 · Published 2026-06-04

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityProgress LoadMaster Command Injection Vulnerability

VendorProgress

ProductLoadMaster

Date added2026-08-07

Due date2026-08-10

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-77

CVSS vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Descriptions

KEV: Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.

NVD: OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-08 13:48 UTC

Wall time55s

Searches7

Component defaultno

Sources https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691
https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/
https://github.com/Caster-chen/CVE-2026-8037-POC
https://www.zerodayinitiative.com/advisories/ZDI-26-342/
https://docs.progress.com/bundle/loadmaster-product-overview-progress-kemp-loadmaster-ltsf/page/RESTful-API-Interface.html
https://thehackernews.com/2026/08/progress-kemp-loadmaster-flaw-hits-cisa.html
https://nvd.nist.gov/vuln/detail/CVE-2026-8037
https://securityboulevard.com/2026/06/progress-loadmaster-api-vulnerability-exposes-systems-to-root-level-command-execution/

Hunting hypothesis agent

Hunt for unauthenticated HTTP POSTs to the /accessv2 API endpoint with sprayed JSON, quote-heavy apiuser values, or shell metacharacters, and for unexpected process execution from the access daemon.

Research details

ComponentREST API /accessv2 endpoint (apiuser/apipass credential handler invoking escape_quotes() in the 'access' daemon)

PreconditionsAdjacent network access (same L2 broadcast domain) to the management interface serving the REST API, which must be enabled (disabled by default). No authentication required; target must run a vulnerable version (GA <= v7.2.63.1 or LTSF <= v7.2.54.17). agent

DeliveryUnauthenticated HTTP POST requests to the REST API /accessv2 endpoint with crafted JSON (sprayed g0-g60 fields plus a 4-single-quote apiuser value) that smuggle shell commands past escape_quotes()

Public PoCyes

PoC URLs https://github.com/Caster-chen/CVE-2026-8037-POC Third-party repos; verify before use.

Advisoryhttps://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS 9.6) | Technique: escape_quotes() returns a non-null-terminated malloc buffer; OOB read into sprayed heap lets an unauthenticated attacker inject shell commands into the system() call | Active exploitation observed since 2026-06-29 (eSentire TRU)

SummaryPre-auth OS command injection (CWE-77) in the REST API /accessv2 endpoint of Progress Kemp LoadMaster, caused by an uninitialized heap buffer in the escape_quotes() sanitizer that permits shell command injection into a system() call for root RCE. Affects GA <= v7.2.63.1 and LTSF <= v7.2.54.17 when the API is enabled; patched in v7.2.63.2 / v7.2.54.18. Public PoCs are available (GitHub, watchTowr Labs) and active exploitation has been observed (792 attempts); CISA added the CVE to KEV on 2026-08-07.

Tia coverage

First reported2026-08-09

First exploit report2026-08-09

Exploit report → KEV2 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-urges-immediate-patching-of-exploited-progress-loadmaster-v progress-kemp-loadmaster-joins-cisa-kev-unauthenticated-command

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.