Live › vulnerability › CVE-2026-8037
Go to dashboardPre-auth OS command injection / RCE in the Progress Kemp LoadMaster API (root; root cause is a missing null terminator in escape_quotes() on the apiuser parameter of the accessv2 endpoint). Affects GA 7.2.63.1 and older and LTSF 7.2.54.17 and older when the API is enabled. Also ECS Connection Manager, Connection Manager for ObjectScale and MOVEit WAF. Public PoC (watchTowr, Jun 29); exploitation seen from Jun 29; CISA KEV Aug 7.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Progress Kemp LoadMaster GA | vendor | <= 7.2.63.1 | 7.2.63.2 |
| Progress Kemp LoadMaster LTSF | vendor | <= 7.2.54.17 | 7.2.54.18 |
| Progress ECS Connection Manager | vendor | <= 7.2.63.1 | 7.2.63.2 |
| Progress Connection Manager for ObjectScale | vendor | <= 7.2.63.1 |
| 7.2.63.2 |
| progress connection manager for objectscale | vendor | < 7.2.63.2 | 7.2.63.2 |
| progress ecs connection manager | vendor | < 7.2.63.2 | 7.2.63.2 |
| progress moveit web application firewall | vendor | < 7.2.63.2 | 7.2.63.2 |
| progress loadmaster | vendor | < 7.2.54.18 | 7.2.54.18 |
| progress loadmaster | vendor | >= 7.2.55.0, < 7.2.63.2 | 7.2.63.2 |
| Progress LoadMaster | vendor | – | – |
7.2.63.1 or LTSF <= 7.2.54.17 AND the API is enabled (check Certificates & Security > Remote Access / enable API interface in the web UI)7.2.63.2 or later, or LTSF 7.2.54.18 or later (ECS Connection Manager and Connection Manager for ObjectScale 7.2.63.2)What vendors did on their customers’ behalf. Holds only for traffic through them; patching is still the fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WAF Release - 2026-07-14 · Changelog
New updates and improvements at Cloudflare.
July 14, 2026
This release introduces new rules targeting critical infrastructure vulnerabilities. These include an unauthenticated memory disclosure flaw in Citrix NetScaler ADC and Gateway (CVE-2026-8451) and a high-severity pre-authentication remote code execution (RCE) vulnerability in Progress Kemp LoadMaster (CVE-2026-8037).
Key Findings
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...76973ac4 | N/A | Citrix Netscaler ADC - Insufficient Input Validation - CVE:CVE-2026-8451 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...10233f36 | N/A | Progress Kemp LoadMaster - Remote Code Execution - CVE:CVE-2026-8037 | Log | Block | This is a new detection. |
This page as .md · .json · in your agent: get_signal("CVE-2026-8037")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.