Vulnerability-Lookup

CVE-2026-8037 (GCVE-0-2026-8037)

Vulnerability from cvelistv5 – Published: 2026-06-04 13:13 – Updated: 2026-08-08 03:55

CISA Shadowserver KEVIntel

Title

OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

Summary

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-04 00:00 UTC

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

ProgressSoftware

References

4 references

URL	Tags
https://community.progress.com/s/article/LoadMast…	vendor-advisory
https://labs.watchtowr.com/enterprise-tech-in-she…	third-party-advisoryexploit
https://www.esentire.com/security-advisories/prog…	media-coverage
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

4 products

Vendor	Product	Version
Progress Software	LoadMaster	Affected: V7.2.60.0 , < V7.2.63.2 (custom) Affected: V7.2.45.12 , < V7.2.54.18 (custom)
Progress Software	ECS Connections Manager	Affected: V7.2.60.0 , < V7.2.63.2 (custom)
Progress Software	Object Scale Connection Manager	Affected: V7.2.60.0 , < V7.2.63.2 (custom)
Progress Software	MOVEit WAF	Affected: V7.2.60.0 , < V7.2.63.2 (custom)

Credits

Jacky Yang and Syed Ibrahim Ahmed of TrendAI Research

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 9e500460-ce3f-41da-bc7c-58d8ebe5193e

Vulnerability ID: CVE-2026-8037

Status: Confirmed

Status Updated: 2026-08-07 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2026-08-07

Asserted: 2026-08-07

Scope

Notes: Progress LoadMaster Command Injection Vulnerability | Affected: Progress / LoadMaster | Description: Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-08-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-8037

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-77
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	LoadMaster
Due Date	2026-08-10
Date Added	2026-08-07
Vendorproject	Progress
Vulnerabilityname	Progress LoadMaster Command Injection Vulnerability
Knownransomwarecampaignuse	Unknown

References

CVE-2026-8037

Created: 2026-08-07 18:00 UTC | Updated: 2026-08-07 18:00 UTC

Shadowserver

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: a27da8f6-2db3-487b-a9a7-110243974b82

Vulnerability ID: CVE-2026-8037

Status: Confirmed

Status Updated: 2026-08-11 00:00 UTC

Exploited: Yes

Characteristics

Severity: 98.0

Timestamps

First Seen: 2026-07-07

Asserted: 2026-07-07

Last Seen: 2026-08-11

Scope

Asset Exposure: ['internet-facing']

Evidence

Type: Honeypot

Signal: In The Wild Attempts

Confidence: 70%

Source: shadowserver

Details

1D	1
Iot	no
Feed	Shadowserver Foundation honeypot/exploited-vulnerabilities
Type	http-scan
Class	other-software
7D Avg	0
Vendor	Progress
30D Avg	0
90D Avg	0
Product	Kemp LoadMaster
Cisa Kev	yes
Connections	6
Observation Date	2026-08-11
Vulnerability Class	CVSS
Vulnerability Score	9.8
Vulnerability Severity	Critical

References

Created: 2026-07-11 01:00 UTC | Updated: 2026-08-13 01:00 UTC

KEVIntel

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: d2df5079-2286-4d5c-a131-546b27ea662c

Vulnerability ID: CVE-2026-8037

Status: Confirmed

Status Updated: 2026-07-01 14:51 UTC

Exploited: Yes

Timestamps

First Seen: 2026-07-01

Asserted: 2026-07-01

Scope

Notes: KEVIntel entry: OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF | Affected: Progress Software / LoadMaster, ECS Connections Manager, Object Scale Connection Manager, MOVEit WAF | CVSS: 9.6 (CRITICAL) | EPSS: 0.0819 | Used in malware: unknown | Not yet in CISA KEV: True

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
Vendor	Progress Software
Product	LoadMaster, ECS Connections Manager, Object Scale Connection Manager, MOVEit WAF
Added Date	2026-07-01T14:51:57.959Z
Cvss Score	9.6
Epss Score	0.0819
Cvss Severity	CRITICAL
Epss Percentile	0.94176
Used In Malware	unknown
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	True

References

Created: 2026-07-01 15:00 UTC | Updated: 2026-07-10 06:14 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8037",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-04T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-08-07",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-08T03:55:14.713Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory",
              "exploit"
            ],
            "url": "https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/"
          },
          {
            "tags": [
              "media-coverage"
            ],
            "url": "https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-08-07T00:00:00.000Z",
            "value": "CVE-2026-8037 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LoadMaster",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "V7.2.63.2",
              "status": "affected",
              "version": "V7.2.60.0",
              "versionType": "custom"
            },
            {
              "lessThan": "V7.2.54.18",
              "status": "affected",
              "version": "V7.2.45.12",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ECS Connections Manager",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "V7.2.63.2",
              "status": "affected",
              "version": "V7.2.60.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Object Scale Connection Manager",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "V7.2.63.2",
              "status": "affected",
              "version": "V7.2.60.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MOVEit WAF",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "V7.2.63.2",
              "status": "affected",
              "version": "V7.2.60.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jacky Yang and Syed Ibrahim Ahmed of TrendAI Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints"
            }
          ],
          "value": "OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An unauthenticated remote attacker exploits unsanitized input in the LoadMaster API command endpoints to inject arbitrary OS commands, resulting in full remote code execution on the appliance."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-04T13:13:45.793Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager \u0026 MOVEit WAF",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003ehtml text\u003c/div\u003e"
            }
          ],
          "value": "plain text"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-8037",
    "datePublished": "2026-06-04T13:13:45.793Z",
    "dateReserved": "2026-05-06T13:35:25.608Z",
    "dateUpdated": "2026-08-08T03:55:14.713Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2026-8037",
      "cwes": "[\"CWE-77\"]",
      "dateAdded": "2026-08-07",
      "dueDate": "2026-08-10",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-8037",
      "product": "LoadMaster",
      "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "shortDescription": "Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.",
      "vendorProject": "Progress",
      "vulnerabilityName": "Progress LoadMaster Command Injection Vulnerability"
    },
    "epss": {
      "cve": "CVE-2026-8037",
      "date": "2026-08-13",
      "epss": "0.99311",
      "percentile": "0.99936"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-8037\",\"sourceIdentifier\":\"security@progress.com\",\"published\":\"2026-06-04T14:16:45.177\",\"lastModified\":\"2026-08-10T20:19:44.760\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo por inyecci\u00f3n de comandos del sistema operativo en la API en Productos Progress ADC permite a un atacante no autenticado ejecutar comandos arbitrarios en el dispositivo LoadMaster explotando la entrada no saneada en m\u00faltiples puntos finales de comando.\"}],\"affected\":[{\"source\":\"security@progress.com\",\"affectedData\":[{\"vendor\":\"Progress Software\",\"product\":\"LoadMaster\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"V7.2.60.0\",\"lessThan\":\"V7.2.63.2\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"V7.2.45.12\",\"lessThan\":\"V7.2.54.18\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Progress Software\",\"product\":\"ECS Connections Manager\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"V7.2.60.0\",\"lessThan\":\"V7.2.63.2\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Progress Software\",\"product\":\"Object Scale Connection Manager\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"V7.2.60.0\",\"lessThan\":\"V7.2.63.2\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Progress Software\",\"product\":\"MOVEit WAF\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"V7.2.60.0\",\"lessThan\":\"V7.2.63.2\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@progress.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.6,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-04T00:00:00+00:00\",\"id\":\"CVE-2026-8037\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"cisaExploitAdd\":\"2026-08-07\",\"cisaActionDue\":\"2026-08-10\",\"cisaRequiredAction\":\"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.\",\"cisaVulnerabilityName\":\"Progress LoadMaster Command Injection Vulnerability\",\"weaknesses\":[{\"source\":\"security@progress.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-77\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:progress:connection_manager_for_objectscale:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"7.2.63.2\",\"matchCriteriaId\":\"029CD311-B604-4813-A75B-4D21806279D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:progress:ecs_connection_manager:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"7.2.63.2\",\"matchCriteriaId\":\"E431D517-8DEE-44FD-AA7B-E5C536574933\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:progress:moveit_web_application_firewall:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"7.2.63.2\",\"matchCriteriaId\":\"56F045CC-CA18-4511-8FE4-9C3AD89E0FA6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:progress:loadmaster:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"7.2.54.18\",\"matchCriteriaId\":\"52829479-F76A-464C-93E2-11A4D090AF99\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:progress:loadmaster:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.2.55.0\",\"versionEndExcluding\":\"7.2.63.2\",\"matchCriteriaId\":\"B5492541-EE6C-41A7-A826-E4D323EB9CBB\"}]}]}],\"references\":[{\"url\":\"https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691\",\"source\":\"security@progress.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]},{\"url\":\"https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:10:38+00:00",
      "cve": "CVE-2026-8037",
      "id": "CVE-2026-8037",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager \u0026 MOVEit WAF",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8037.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-8037\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-07T17:45:04.515830Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2026-08-07\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037\"}}}], \"references\": [{\"url\": \"https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/\", \"tags\": [\"third-party-advisory\", \"exploit\"]}, {\"url\": \"https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037\", \"tags\": [\"media-coverage\"]}, {\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037\", \"tags\": [\"government-resource\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-10T10:34:16.964Z\"}, \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-08-07T00:00:00.000Z\", \"value\": \"CVE-2026-8037 added to CISA KEV\"}]}], \"cna\": {\"title\": \"OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager \u0026 MOVEit WAF\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Jacky Yang and Syed Ibrahim Ahmed of TrendAI Research\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"An unauthenticated remote attacker exploits unsanitized input in the LoadMaster API command endpoints to inject arbitrary OS commands, resulting in full remote code execution on the appliance.\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.6, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Progress Software\", \"product\": \"LoadMaster\", \"versions\": [{\"status\": \"affected\", \"version\": \"V7.2.60.0\", \"lessThan\": \"V7.2.63.2\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"V7.2.45.12\", \"lessThan\": \"V7.2.54.18\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Progress Software\", \"product\": \"ECS Connections Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"V7.2.60.0\", \"lessThan\": \"V7.2.63.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Progress Software\", \"product\": \"Object Scale Connection Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"V7.2.60.0\", \"lessThan\": \"V7.2.63.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Progress Software\", \"product\": \"MOVEit WAF\", \"versions\": [{\"status\": \"affected\", \"version\": \"V7.2.60.0\", \"lessThan\": \"V7.2.63.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691\", \"tags\": [\"vendor-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"plain text\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cdiv\u003ehtml text\u003c/div\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-77\", \"description\": \"CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"f9fea0b6-671e-4eea-8fde-31911902ae05\", \"shortName\": \"ProgressSoftware\", \"dateUpdated\": \"2026-06-04T13:13:45.793Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-8037\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-08T03:55:14.713Z\", \"dateReserved\": \"2026-05-06T13:35:25.608Z\", \"assignerOrgId\": \"f9fea0b6-671e-4eea-8fde-31911902ae05\", \"datePublished\": \"2026-06-04T13:13:45.793Z\", \"assignerShortName\": \"ProgressSoftware\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0883

Vulnerability from certfr_avis - Published: 2026-07-15 - Updated: 2026-07-15

De multiples vulnérabilités ont été découvertes dans Progress LoadMaster. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Progress	LoadMaster	LoadMaster GA versions antérieures à v7.2.63.2
Progress	N/A	ECS Connection Manager versions antérieures à v7.2.63.2
Progress	N/A	Connection Manager for ObjectScale versions antérieures à v7.2.63.2
Progress	LoadMaster	LoadMaster LTFS versions antérieures à v7.2.54.18

References

Title

Publication Time

FKIE_CVE-2026-8037

Vulnerability from fkie_nvd - Published: 2026-06-04 14:16 - Updated: 2026-07-22 20:10

CISA Shadowserver KEVIntel

Severity

9.6 (Critical) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security@progress.com	https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691	Vendor Advisory, Patch
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/	Exploit, Patch, Third Party Advisory

Impacted products

Vendor	Product	Version
progress	connection_manager_for_objectscale	*
progress	ecs_connection_manager	*
progress	loadmaster	*
progress	loadmaster	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "LoadMaster",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "V7.2.63.2",
              "status": "affected",
              "version": "V7.2.60.0",
              "versionType": "custom"
            },
            {
              "lessThan": "V7.2.54.18",
              "status": "affected",
              "version": "V7.2.45.12",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ECS Connections Manager",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "V7.2.63.2",
              "status": "affected",
              "version": "V7.2.60.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Object Scale Connection Manager",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "V7.2.63.2",
              "status": "affected",
              "version": "V7.2.60.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MOVEit WAF",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "V7.2.63.2",
              "status": "affected",
              "version": "V7.2.60.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@progress.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:progress:connection_manager_for_objectscale:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "029CD311-B604-4813-A75B-4D21806279D2",
              "versionEndExcluding": "7.2.63.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:progress:ecs_connection_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E431D517-8DEE-44FD-AA7B-E5C536574933",
              "versionEndExcluding": "7.2.63.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:progress:loadmaster:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "52829479-F76A-464C-93E2-11A4D090AF99",
              "versionEndExcluding": "7.2.54.18",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:progress:loadmaster:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B5492541-EE6C-41A7-A826-E4D323EB9CBB",
              "versionEndExcluding": "7.2.63.2",
              "versionStartIncluding": "7.2.55.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints"
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo por inyecci\u00f3n de comandos del sistema operativo en la API en Productos Progress ADC permite a un atacante no autenticado ejecutar comandos arbitrarios en el dispositivo LoadMaster explotando la entrada no saneada en m\u00faltiples puntos finales de comando."
    }
  ],
  "id": "CVE-2026-8037",
  "lastModified": "2026-07-22T20:10:00.127",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0,
        "source": "security@progress.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-8037",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-04T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-04T14:16:45.177",
  "references": [
    {
      "source": "security@progress.com",
      "tags": [
        "Vendor Advisory",
        "Patch"
      ],
      "url": "https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/"
    }
  ],
  "sourceIdentifier": "security@progress.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ],
      "source": "security@progress.com",
      "type": "Secondary"
    }
  ]
}

GHSA-57PC-JM9R-HGJ4

Vulnerability from github – Published: 2026-06-04 15:30 – Updated: 2026-08-07 18:31

Details

Severity

9.6 (Critical)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-8037"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-04T14:16:45Z",
    "severity": "CRITICAL"
  },
  "details": "OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints",
  "id": "GHSA-57pc-jm9r-hgj4",
  "modified": "2026-08-07T18:31:35Z",
  "published": "2026-06-04T15:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8037"
    },
    {
      "type": "WEB",
      "url": "https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691"
    },
    {
      "type": "WEB",
      "url": "https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037"
    },
    {
      "type": "WEB",
      "url": "https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2026-1812

Vulnerability from csaf_certbund - Published: 2026-06-07 22:00 - Updated: 2026-07-01 22:00

Summary

Kemp LoadMaster: Mehrere Schwachstellen

Severity

Kritisch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: LoadMaster ist eine Load Balancer Lösung von Progress Software.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Kemp LoadMaster ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren oder beliebigen Code auszuführen.

Betroffene Betriebssysteme: - Sonstiges

CVE-2026-33691

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Progress Software LoadMaster LTSF <7.2.54.18 Kemp / LoadMaster		LTSF <7.2.54.18
Progress Software LoadMaster GA <7.2.63.2 Kemp / LoadMaster		GA <7.2.63.2

CVE-2026-8037

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Progress Software LoadMaster LTSF <7.2.54.18 Kemp / LoadMaster		LTSF <7.2.54.18
Progress Software LoadMaster GA <7.2.63.2 Kemp / LoadMaster		GA <7.2.63.2

References

7 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://community.progress.com/s/article/LoadMast…	external
https://www.cve.org/CVERecord?id=CVE-2026-8037	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33691	external
https://labs.watchtowr.com/enterprise-tech-in-she…	external
https://www.esentire.com/security-advisories/prog…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "kritisch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "LoadMaster ist eine Load Balancer L\u00f6sung von Progress Software.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Kemp LoadMaster ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren oder beliebigen Code auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1812 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1812.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1812 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1812"
      },
      {
        "category": "external",
        "summary": "LoadMaster Critical Security Bulletin vom 2026-06-07",
        "url": "https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691"
      },
      {
        "category": "external",
        "summary": "CVERecord vom 2026-06-07",
        "url": "https://www.cve.org/CVERecord?id=CVE-2026-8037"
      },
      {
        "category": "external",
        "summary": "NIST Vulnerability Database vom 2026-06-07",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33691"
      },
      {
        "category": "external",
        "summary": "Watchtowr Vulnerability Research vom 2026-06-30",
        "url": "https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/"
      },
      {
        "category": "external",
        "summary": "Esentire Security Advisory vom 2026-07-01",
        "url": "https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037"
      }
    ],
    "source_lang": "en-US",
    "title": "Kemp LoadMaster: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-07-01T22:00:00.000+00:00",
      "generator": {
        "date": "2026-07-02T08:30:53.855+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1812",
      "initial_release_date": "2026-06-07T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-06-07T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-06-09T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: ZDI-26-342, ZDI-CAN-30437, ZDI-26-340, ZDI-CAN-30438, ZDI-26-341, ZDI-CAN-30439"
        },
        {
          "date": "2026-06-30T22:00:00.000+00:00",
          "number": "3",
          "summary": "PoC aufgenommen"
        },
        {
          "date": "2026-07-01T22:00:00.000+00:00",
          "number": "4",
          "summary": "Aktive Ausnutzung gemeldet"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "GA \u003c7.2.63.2",
                "product": {
                  "name": "Progress Software LoadMaster GA \u003c7.2.63.2",
                  "product_id": "T055029"
                }
              },
              {
                "category": "product_version",
                "name": "GA 7.2.63.2",
                "product": {
                  "name": "Progress Software LoadMaster GA 7.2.63.2",
                  "product_id": "T055029-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:kemptechnologies:loadmaster:ga__7.2.63.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "LTSF \u003c7.2.54.18",
                "product": {
                  "name": "Progress Software LoadMaster LTSF \u003c7.2.54.18",
                  "product_id": "T055030"
                }
              },
              {
                "category": "product_version",
                "name": "LTSF 7.2.54.18",
                "product": {
                  "name": "Progress Software LoadMaster LTSF 7.2.54.18",
                  "product_id": "T055030-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:kemptechnologies:loadmaster:ltsf__7.2.54.18"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "LoadMaster"
          }
        ],
        "category": "vendor",
        "name": "Kemp"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-33691",
      "product_status": {
        "known_affected": [
          "T055030",
          "T055029"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-33691"
    },
    {
      "cve": "CVE-2026-8037",
      "product_status": {
        "known_affected": [
          "T055030",
          "T055029"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-8037"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-8037 (GCVE-0-2026-8037)

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

Shadowserver

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Characteristics

Timestamps

Scope

Evidence

Honeypot In The Wild Attempts Confidence: 70% Source: shadowserver

Details

References

KEVIntel

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: kevintel

Details

References

CERTFR-2026-AVI-0883

Solutions

FKIE_CVE-2026-8037

GHSA-57PC-JM9R-HGJ4

WID-SEC-W-2026-1812

Tags

Sightings

Nomenclature