CISA added CVE-2026-8037, an unauthenticated pre-auth remote code execution flaw in Progress LoadMaster and related ADC products, to the Known Exploited Vulnerabilities catalog on August 7, 2026, with a federal remediation deadline of August 10, 2026.
What Is It
CVE-2026-8037 is classified by NVD as an OS command injection vulnerability (CWE-77) in the API of Progress ADC products. Per the NVD description, unsanitized input across multiple command endpoints allows an unauthenticated attacker to execute arbitrary commands on the LoadMaster appliance; no credentials, no user interaction.
The root-cause characterization is not settled across sources. The watchTowr Labs writeup cited by NVD for this same CVE describes the bug as an uninitialized heap condition leading to pre-auth RCE, a memory-corruption class, not input sanitization. The two descriptions are difficult to reconcile as characterizations of the same code path, though they are not necessarily mutually exclusive: a single attack chain can span both, and it is possible the two sources are describing different stages or different underlying defects grouped under one CVE. No public reconciliation of the two accounts appears to be available at the time of writing. What is consistent across all of them is the outcome and the precondition: unauthenticated remote code execution on the appliance. Treat the CWE-77 label as provisional and the pre-auth RCE impact as firm.
Scoring is split between the two assigning sources. NVD rates it 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), treating it as network-reachable. Progress rates it 9.6 CRITICAL (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), scoping the attack vector to adjacent network but with changed scope.
Why It Matters
CISA's SSVC assessment for this CVE marks exploitation as active with total technical impact, and its presence in the KEV catalog confirms exploitation in the wild. Known ransomware campaign use is listed as Unknown.
The target is a load balancer / application delivery controller; a device that by design sits in front of other infrastructure and terminates traffic. Pre-auth RCE on that appliance is a full compromise of the device. A third-party writeup from watchTowr Labs and an eSentire advisory describing targeting of this flaw are both cited as NVD references.
What's Vulnerable
Four Progress products share the affected code base:
- LoadMaster: V7.2.45.12 up to (not including) V7.2.54.18, and V7.2.60.0 up to (not including) V7.2.63.2. NVD's CPE configuration is broader, covering LoadMaster below 7.2.54.18 and 7.2.55.0 through 7.2.63.2; note that NVD's upper bound is stated inclusively, which would mark 7.2.63.2 itself as vulnerable, while the Progress advisory treats 7.2.63.2 as the first unaffected build. Where the two disagree, the vendor boundary is the one to patch to.
- ECS Connections Manager: V7.2.60.0 to before V7.2.63.2
- Object Scale Connection Manager: V7.2.60.0 to before V7.2.63.2
- MOVEit WAF: V7.2.60.0 to before V7.2.63.2
Patch Status
Progress does not publish an explicit fixed-build list in the bulletin; V7.2.63.2 and V7.2.54.18 are the fixed builds inferred from the upper bounds of the affected-version ranges. The bulletin itself is dated June 2026, so patched builds have been available for roughly two months ahead of the KEV addition; this is a catch-up deadline on an existing patch, not a zero-day scramble.
CISA's required action: apply mitigations per vendor instructions in compliance with BOD 26-04 and CISA's Forensics Triage Requirements; follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure. Due date is August 10, 2026: three days from KEV addition.
Sources
- Progress Security Bulletin; https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691
- CISA KEV Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037
- NVD, https://nvd.nist.gov/vuln/detail/CVE-2026-8037
- watchTowr Labs; https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/
- eSentire Advisory; https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037
- CISA BOD 26-04; https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk