CVE-2026-8037: Critical Vulnerability in Progress LoadMaster Actively Exploited

CVE-2026-8037: Critical Vulnerability in Progress LoadMaster Actively Exploited

In short

CVE-2026-8037 is a critical command injection vulnerability in Progress LoadMaster, with a CVSS score of 9.6 out of 10, rated critical by NVD [1] and published on June 4, 2026 [1]. It is included in CISA's Known Exploited Vulnerabilities (KEV) catalog [2]. It allows an attacker, without needing to authenticate, to execute arbitrary commands on the appliance by leveraging unsanitized input in several of its API endpoints [1]. If your organization uses Progress LoadMaster, today's recommendation is to identify whether the appliance is exposed, check whether security updates are available from the vendor, and apply them urgently.

What it is and why it matters

According to the official NVD entry, this is an OS Command Injection vulnerability present in the API of Progress's ADC products, which allows an unauthenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints [1]. Since it does not require prior authentication, any attacker with network access to the appliance could attempt to exploit it directly.

The combination of three factors notably raises the risk: a CVSS score of 9.6, in the highest range of the scale [1]; a critical severity classification from NVD [1]; and its presence in CISA's KEV catalog, which gathers vulnerabilities with confirmed evidence of active exploitation [2]. Our internal intelligence radar at OCIRIA, built from these same public NVD and CISA KEV data, categorizes it under "Command Injection" with critical severity, precisely because of this unauthenticated-access and remote-code-execution profile.

Who is affected

The affected vendor, according to NVD, is Progress, specifically its ADC (Application Delivery Controller) products, on the LoadMaster appliance [1]. The structured data available does not specify particular affected or patched versions, so we cannot state here which builds are or are not at risk: that information must be confirmed directly in the vendor's official advisory for the specific appliance you operate.

As general guidance, this type of device (load balancers / application delivery controllers) tends to sit at critical points in the network, managing traffic to internal or internet-facing applications, which makes it especially important to confirm as soon as possible whether the product is in use in your infrastructure.

How to know if you're vulnerable

• Confirm whether your organization has Progress LoadMaster (or Progress ADC products) deployed in your infrastructure inventory, including appliances managed by third parties.
• Check the official vendor advisory to verify which versions are affected and whether your installation corresponds to any of them.
• Review whether the appliance's management interface or API is accessible from untrusted networks or from the internet; since no authentication is required, network exposure is itself a significant risk factor [1].
• Periodically check your exposed attack surface: many organizations discover too late that an admin panel or API was accessible from outside due to a configuration error.

How to protect yourself

1. Identify all Progress LoadMaster / ADC appliances in your inventory, including those managed by third-party vendors.

2. Apply the vendor's security update as soon as it is available for your version; since the vulnerability is listed in KEV [2], this is a priority, not something to postpone.

3. While the patch is being deployed, restrict access to the appliance's management interface and API to trusted networks only (VPN, access lists, network segmentation).

4. Review the appliance's logs and alerts for anomalous activity on the command endpoints, especially if the device has been exposed to the internet.

5. Establish a recurring process for reviewing vendor advisories and your exposed attack surface, since vulnerabilities of this type tend to reappear repeatedly in perimeter network devices.

Frequently asked questions

Is this a serious vulnerability? Yes. It has a CVSS score of 9.6 and is classified as critical by NVD [1].

Is it being actively exploited? It is included in CISA's KEV catalog, which lists vulnerabilities with evidence of active exploitation [2].

Do I need to be authenticated to be affected? No. According to the official description, an unauthenticated attacker can execute arbitrary commands by exploiting unsanitized input in the appliance's API [1].

Which versions are affected? The available information does not specify particular versions; you should check the official vendor advisory for your specific installation.

Sources

• [1] https://nvd.nist.gov/vuln/detail/CVE-2026-8037
• [2] https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json