OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
Published Jun 4, 2026 ·Due Aug 10, 2026
9.8
CRITICALCVSS 3.1
EPSS 77.36%
Description
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
Affected products
-
- Version V7.2.60.0StatusaffectedConstraints<V7.2.63.2
- Version
-
- Version V7.2.45.12StatusaffectedConstraints<V7.2.54.18
- Version V7.2.60.0StatusaffectedConstraints<V7.2.63.2
- Version
-
- Version V7.2.60.0StatusaffectedConstraints<V7.2.63.2
- Version
-
- Version V7.2.60.0StatusaffectedConstraints<V7.2.63.2
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Progress Software | ECS Connections Manager | unaffected |
| |||||||||
| Progress Software | LoadMaster | unaffected |
| |||||||||
| Progress Software | MOVEit WAF | unaffected |
| |||||||||
| Progress Software | Object Scale Connection Manager | unaffected |
|
- < 7.2.63.2
- < 7.2.63.2
- < 7.2.63.2
- < 7.2.54.18
- ≥ 7.2.55.0 · < 7.2.63.2
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
plain text
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1 other source (CVE.org) ▾
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
Date Added
Aug 7, 2026
Patch Due
Aug 10, 2026
Required Action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
ActiveAutomatable
NoTechnical Impact
TotalDecision
n/aAssessed Oct 1, 2026 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
Jun–Oct 2026- EPSS v4
- EPSS v5
Percentile over time
- EPSS v4
- EPSS v5
Table of values (10 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 77.36% (0.77362) | 99.54th | v5 (v2026.06.15) |
| Sep 20, 2026 | 99.57% (0.99571) | 99.95th | v5 (v2026.06.15) |
| Aug 8, 2026 | 99.31% (0.99311) | 99.94th | v5 (v2026.06.15) |
| Jul 24, 2026 | 84.79% (0.84793) | 99.69th | v5 (v2026.06.15) |
| Jul 14, 2026 | 43.43% (0.43430) | 98.59th | v5 (v2026.06.15) |
| Jul 2, 2026 | 29.64% (0.29641) | 97.96th | v5 (v2026.06.15) |
| Jul 1, 2026 | 8.19% (0.08190) | 94.18th | v5 (v2026.06.15) |
| Jun 23, 2026 | 1.87% (0.01869) | 76.61th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.83% (0.00834) | 52.72th | v5 (v2026.06.15) |
| Jun 5, 2026 | 0.30% (0.00300) | 53.63th | v4 (v2025.03.14) |
References (4)
- https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691 vendor-advisoryPatchVendor Advisory
- https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/ third-party-advisoryexploitPatchThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037 government-resourceUS Government Resource
- https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037 media-coverageThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691 | vendor-advisoryPatchVendor Advisory | |
| https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/ | third-party-advisoryexploitPatchThird Party Advisory | |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037 | government-resourceUS Government Resource | |
| https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037 | media-coverageThird Party Advisory |
Change history (3)
- CISA ADP
- SSVC exploitation changed from poc to
active poc → active
- SSVC exploitation changed from poc to
active
- CISA ADP
- SSVC exploitation changed from active to
poc active → poc
- SSVC exploitation changed from active to
poc
- CISA ADP
- SSVC exploitation changed from poc to
active poc → active
- SSVC exploitation changed from poc to
active