NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Progress LoadMaster command injection CVE-2026-8037 used in attacks; firmware fixes available

Attackers are exploiting a command injection flaw in Progress LoadMaster and related business appliances without logging in. Ask IT to install firmware 7.2.63.2, or 7.2.54.18 for LoadMaster LTSF, and check for compromise.

What to do

Nothing to update on an ordinary family phone or computer: these are business appliances. If your business or family office uses them, ask IT to install 7.2.63.2, or 7.2.54.18 for LoadMaster LTSF, and investigate whether an unpatched appliance was compromised.

What’s happening

CVE-2026-8037 lets an attacker run operating-system commands on vulnerable Progress appliances without logging in. It affects LoadMaster and related connection-management and firewall products used by organisations. Progress disclosed the flaw on 4 June, and fixes are available for the affected supported products. eSentire observed exploitation attempts from 29 June, although those it investigated failed. Progress's bulletin, dated 31 July, still says it has received no exploitation reports; CISA subsequently confirmed exploitation by adding the flaw to its catalogue on 7 August. The reviewed reporting does not establish how many organisations were compromised or what attackers stole. As at 3 November, updating remains the required response; CISA's listing does not mean patched appliances are vulnerable.

What
Flaw
Affects
Progress Kemp LoadMaster, ECS Connection Manager, Connection Manager for ObjectScale and MOVEit WAF
Affected
Progress LoadMaster V7.2.60.0 to before V7.2.63.2, and V7.2.45.12 to before V7.2.54.18, according to Progress's CVE record; its bulletin describes GA v7.2.63.1 and older and LTSF v7.2.54.17 and older more broadly.
Progress ECS Connection Manager v7.2.63.1 and all prior versions, according to the vendor bulletin.
Progress Connection Manager for ObjectScale v7.2.63.1 and all prior versions, according to the vendor bulletin.
Progress MOVEit WAF V7.2.60.0 to before V7.2.63.2, according to Progress's CVE record.
Fixed in
Progress Kemp LoadMaster GA v7.2.63.2
Progress Kemp LoadMaster LTSF v7.2.54.18
Progress ECS Connection Manager v7.2.63.2
Progress Connection Manager for ObjectScale v7.2.63.2
Progress MOVEit WAF v7.2.63.2
CVE
CVE-2026-8037
Since
7 Aug 2026
Closed
7 Aug 2026

Timeline

  1. CISA added

    CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalogue and required US federal civilian agencies to apply the fixes by 10 August.

  2. Update

    Progress's bulletin listed fixed firmware for LoadMaster GA and LTSF, ECS Connection Manager and Connection Manager for ObjectScale. It continued to say Progress had received no exploitation reports.

  3. Wider attacks

    eSentire began detecting attempts to exploit CVE-2026-8037. Its observed attempts failed, and it saw no subsequent activity from a successful compromise.

  4. New fix

    Progress documented a fix for CVE-2026-8037 in LoadMaster LTSF 7.2.54.18, covering command injection in the cipher settings interface and API.

Sources

  1. LoadMaster Critical Security Bulletin – June 2026Progress · 31 July 2026
  2. LoadMaster 7.2.54.18 Release Notes: Security UpdatesProgress · 4 June 2026
  3. Progress's CVE-2026-8037 record, reproduced by OpenCVEProgress Software via OpenCVE · 4 June 2026
  4. Progress Kemp LoadMaster Vulnerability Targeted (CVE-2026-8037)eSentire · 30 June 2026
  5. Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit AttemptsThe Hacker News · 8 Aug 2026
  6. Critical Progress LoadMaster flaw now actively exploited in attacksBleepingComputer · 10 Aug 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from August 2026 · JSON · RSS