Progress LoadMaster Command Injection Vulnerability
TL;DR 📌
- Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.
- Highest CVSS: 9.6 (Critical).
- Listed in CISA KEV (2026-08-07) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-8037.
What it is
CVE-2026-8037 is a command injection vulnerability in Progress LoadMaster, the vendor’s load balancer/ADC appliance. The flaw sits in multiple command endpoints where input is not properly sanitised before being passed through to the underlying system.
The attack vector is adjacent network (AV:A), meaning an attacker needs some form of network access to the appliance’s management interface rather than being reachable from anywhere on the internet, but no authentication or user interaction is required (PR:N, UI:N). Given that combination, anyone who can reach the relevant endpoint can inject commands directly.
The impact is a full compromise of confidentiality, integrity and availability on the appliance, with a scope change indicating the exploit can affect resources beyond the vulnerable component itself. This is consistent with arbitrary command execution on the LoadMaster host.
CVE-2026-8037 is listed in the CISA Known Exploited Vulnerabilities catalogue, added on 2026-08-07, so it is known to be exploited.
What to do
- Treat this as urgent: CVSS 9.6, unauthenticated, no user interaction, and already in CISA KEV.
- Consult the Progress advisory for LoadMaster for a fixed release — none is stated here, so check directly with the vendor before assuming a patch exists.
- Restrict network access to the LoadMaster management interface immediately; do not expose it to untrusted networks while remediation is pending.
- Review LoadMaster logs for signs of unexpected command execution or unusual activity on management endpoints.
- Track the advisory for an updated fix, and apply it as soon as it is published given the KEV listing.
For leadership 🧭
Executive summary. Progress LoadMaster, used as a load balancer/ADC, can be fully compromised by anyone who can reach its management interface, without needing a password or user interaction. This is already listed in CISA’s Known Exploited Vulnerabilities catalogue, so it needs attention today, not at the next patch cycle.
Why it matters:
- The flaw sits in multiple LoadMaster command endpoints, so an attacker reaching the management interface can inject commands directly into the underlying appliance OS.
- No authentication or user interaction is required, and the scope change means impact can extend beyond LoadMaster itself to other resources it touches.
- CISA added this to its Known Exploited Vulnerabilities catalogue on 2026-08-07, confirming active exploitation rather than theoretical risk.
- LoadMaster typically sits in front of critical application traffic, so command execution on the appliance can affect availability and integrity of everything it balances.
Now / Next / Later:
- Now: Restrict all network access to the LoadMaster management interface to trusted hosts only, and check the Progress advisory for CVE-2026-8037 to see if a fixed release is available.
- Next: Apply the vendor’s fixed release to LoadMaster as soon as it is published, and review appliance logs for unexpected command execution or unusual activity on management endpoints in the meantime.
- Later: Segment LoadMaster management access behind a jump host or VPN so it is never reachable from adjacent untrusted networks, and add LoadMaster to routine KEV-tracking for future advisories.