← Back

CVE-2026-8037

nvd nistnuclei
Published: Jun 4, 2026Modified: Aug 10, 2026CISA KEV

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

Affected (5)

Progress
4 products
Connection Manager For Objectscale
Ecs Connection Manager
Loadmaster
Moveit Web Application Firewall
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Connection Manager For Objectscale
Before 7.2.63.2
Ecs Connection Manager
Before 7.2.63.2
Progress
Loadmaster
Before 7.2.54.18
Loadmaster
From 7.2.55.0 to 7.2.63.2
Moveit Web Application Firewall
Before 7.2.63.2

Related CWEs

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (4)

Source: security@progress.com
PatchVendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitPatchThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Third Party Advisory

Timeline

No history available yet.