{"id":"progress-loadmaster-command-injection-jun-2026","category":"patch","status":"closed","title":"Progress LoadMaster command injection CVE-2026-8037 used in attacks; firmware fixes available","tldr":"Attackers are exploiting a command injection flaw in Progress LoadMaster and related business appliances without logging in. Ask IT to install firmware 7.2.63.2, or 7.2.54.18 for LoadMaster LTSF, and check for compromise.","summary":"CVE-2026-8037 lets an attacker run operating-system commands on vulnerable Progress appliances without logging in. It affects LoadMaster and related connection-management and firewall products used by organisations. Progress disclosed the flaw on 4 June, and fixes are available for the affected supported products. eSentire observed exploitation attempts from 29 June, although those it investigated failed. Progress's bulletin, dated 31 July, still says it has received no exploitation reports; CISA subsequently confirmed exploitation by adding the flaw to its catalogue on 7 August. The reviewed reporting does not establish how many organisations were compromised or what attackers stole. As at 3 November, updating remains the required response; CISA's listing does not mean patched appliances are vulnerable.","action":"Nothing to update on an ordinary family phone or computer: these are business appliances. If your business or family office uses them, ask IT to install 7.2.63.2, or 7.2.54.18 for LoadMaster LTSF, and investigate whether an unpatched appliance was compromised.","product":"Progress Kemp LoadMaster, ECS Connection Manager, Connection Manager for ObjectScale and MOVEit WAF","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-8037"],"tags":["progress","loadmaster","moveit-waf","command-injection","actively-exploited"],"affected":["Progress LoadMaster V7.2.60.0 to before V7.2.63.2, and V7.2.45.12 to before V7.2.54.18, according to Progress's CVE record; its bulletin describes GA v7.2.63.1 and older and LTSF v7.2.54.17 and older more broadly.","Progress ECS Connection Manager v7.2.63.1 and all prior versions, according to the vendor bulletin.","Progress Connection Manager for ObjectScale v7.2.63.1 and all prior versions, according to the vendor bulletin.","Progress MOVEit WAF V7.2.60.0 to before V7.2.63.2, according to Progress's CVE record."],"fixed":["Progress Kemp LoadMaster GA v7.2.63.2","Progress Kemp LoadMaster LTSF v7.2.54.18","Progress ECS Connection Manager v7.2.63.2","Progress Connection Manager for ObjectScale v7.2.63.2","Progress MOVEit WAF v7.2.63.2"],"matches":[],"sources":[{"kind":"advisory","title":"LoadMaster Critical Security Bulletin – June 2026","url":"https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691","by":"Progress","date":"2026-07-31"},{"kind":"advisory","title":"LoadMaster 7.2.54.18 Release Notes: Security Updates","url":"https://docs.progress.com/bundle/release-notes_loadmaster-7-2-54-18/page/Security-Updates.html","by":"Progress","date":"2026-06-04"},{"kind":"advisory","title":"Progress's CVE-2026-8037 record, reproduced by OpenCVE","url":"https://opencve.alliance.unm.edu/cve/CVE-2026-8037","by":"Progress Software via OpenCVE","date":"2026-06-04"},{"kind":"research","title":"Progress Kemp LoadMaster Vulnerability Targeted (CVE-2026-8037)","url":"https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037","by":"eSentire","date":"2026-06-30"},{"kind":"news","title":"Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts","url":"https://thehackernews.com/2026/08/progress-kemp-loadmaster-flaw-hits-cisa.html","by":"The Hacker News","date":"2026-08-08"},{"kind":"news","title":"Critical Progress LoadMaster flaw now actively exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-progress-loadmaster-flaw-exploited-in-attacks/","by":"BleepingComputer","date":"2026-08-10"}],"started":"2026-08-07","closed":"2026-08-07","created":"2026-11-03T22:13:53.725Z","updated":"2026-11-03T22:13:53.725Z","cve_notes":[{"cve":"CVE-2026-8037","name":"Command injection in Progress LoadMaster's API","what":"Inadequate handling of API input in Progress LoadMaster and related appliances allows an attacker without login credentials to run operating-system commands.","severity":"critical","cvss":9.6}],"timeline":[{"at":"2026-08-07","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalogue and required US federal civilian agencies to apply the fixes by 10 August.","url":"https://thehackernews.com/2026/08/progress-kemp-loadmaster-flaw-hits-cisa.html","by":"The Hacker News","patch":null},{"at":"2026-07-31","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Progress's bulletin listed fixed firmware for LoadMaster GA and LTSF, ECS Connection Manager and Connection Manager for ObjectScale. It continued to say Progress had received no exploitation reports.","url":"https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691","by":"Progress","patch":null},{"at":"2026-06-29","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"eSentire began detecting attempts to exploit CVE-2026-8037. Its observed attempts failed, and it saw no subsequent activity from a successful compromise.","url":"https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037","by":"eSentire","patch":null},{"at":"2026-06-04","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Progress documented a fix for CVE-2026-8037 in LoadMaster LTSF 7.2.54.18, covering command injection in the cipher settings interface and API.","url":"https://docs.progress.com/bundle/release-notes_loadmaster-7-2-54-18/page/Security-Updates.html","by":"Progress","patch":null}],"url":"https://hard.fyi/live/progress-loadmaster-command-injection-jun-2026/","json":"https://hard.fyi/api/live?id=progress-loadmaster-command-injection-jun-2026"}