{"id":"CVE-2026-8037","kind":"vulnerability","aliases":["CVE-2026-8037"],"related":[],"title":"OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated…","description":"WAF Release - 2026-07-14 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nJuly 14, 2026\n\n## WAF Release - 2026-07-14\n\nThis release introduces new rules targeting critical infrastructure vulnerabilities. These include an unauthenticated memory disclosure flaw in Citrix NetScaler ADC and Gateway (CVE-2026-8451) and a high-severity pre-authentication remote code execution (RCE) vulnerability in Progress Kemp LoadMaster (CVE-2026-8037).\n\nKey Findings\n\n- CVE-2026-8451: An insufficient input validation vulnerability affects Citrix NetScaler ADC and NetScaler Gateway appliances configured as a SAML Identity Provider (IdP). Remote, unauthenticated attackers can exploit this flaw by sending malformed requests to trigger a memory overread, allowing them to leak chunks of sensitive data from adjacent appliance memory.\n- CVE-2026-8037: A critical OS command injection vulnerability in Progress Kemp LoadMaster load balancers allows unauthenticated remote attackers to achieve remote code execution (RCE).\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...76973ac4 | N/A | Citrix Netscaler ADC - Insufficient Input Validation - CVE:CVE-2026-8451 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...10233f36 | N/A | Progress Kemp LoadMaster - Remote Code Execution - CVE:CVE-2026-8037 | Log | Block | This is a new detection. |","summary":"Pre-auth OS command injection / RCE in the Progress Kemp LoadMaster API (root; root cause is a missing null terminator in escape_quotes() on the apiuser parameter of the accessv2 endpoint). Affects GA 7.2.63.1 and older and LTSF 7.2.54.17 and older when the API is enabled. Also ECS Connection Manager, Connection Manager for ObjectScale and MOVEit WAF. Public PoC (watchTowr, Jun 29); exploitation seen from Jun 29; CISA KEV Aug 7.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-08-07T00:00:00+00:00","products":[{"name":"Progress Kemp LoadMaster GA","fixed":["7.2.63.2"],"affected":"<= 7.2.63.1","ecosystem":"vendor"},{"name":"Progress Kemp LoadMaster LTSF","fixed":["7.2.54.18"],"affected":"<= 7.2.54.17","ecosystem":"vendor"},{"name":"Progress ECS Connection Manager","fixed":["7.2.63.2"],"affected":"<= 7.2.63.1","ecosystem":"vendor"},{"name":"Progress Connection Manager for ObjectScale","fixed":["7.2.63.2"],"affected":"<= 7.2.63.1","ecosystem":"vendor"},{"name":"progress connection manager for objectscale","fixed":["7.2.63.2"],"affected":"< 7.2.63.2","ecosystem":"vendor"},{"name":"progress ecs connection manager","fixed":["7.2.63.2"],"affected":"< 7.2.63.2","ecosystem":"vendor"},{"name":"progress moveit web application firewall","fixed":["7.2.63.2"],"affected":"< 7.2.63.2","ecosystem":"vendor"},{"name":"progress loadmaster","fixed":["7.2.54.18"],"affected":"< 7.2.54.18","ecosystem":"vendor"},{"name":"progress loadmaster","fixed":["7.2.63.2"],"affected":">= 7.2.55.0, < 7.2.63.2","ecosystem":"vendor"},{"name":"Progress LoadMaster","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["appliance","cloudflare","exploited","infrastructure","kemp","lab-disclosure","load-balancer","poc-public","progress-loadmaster","self-hosted"],"not_affected_if":["api-disabled","no-loadmaster-deployed","patched-7.2.63.2"],"how_to_check":"Web UI: the version string is top-right (or the console at boot). Vulnerable if GA <= 7.2.63.1 or LTSF <= 7.2.54.17 AND the API is enabled (check Certificates & Security > Remote Access / enable API interface in the web UI). Check whether the management UI/API is reachable from untrusted networks, and review logs for requests to the accessv2 endpoint with quote characters in apiuser. Vendor says no known IOCs.","fix":"Upgrade to GA 7.2.63.2 or later, or LTSF 7.2.54.18 or later (ECS Connection Manager and Connection Manager for ObjectScale 7.2.63.2). Disable the API and restrict management access to trusted networks until patched. Review for prior compromise, since exploitation began in June.","status":"resolved","published_at":"2026-06-04T14:16:45+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:32:00+00:00","updated_at":"2026-10-24T18:43:45+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T20:32:00Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patch for CVE-2026-8037 per Progress guidance; the sources do not name a fixed version. If no mitigation exists, CISA says to discontinue use of the product.","summary":"Progress LoadMaster, a load balancer appliance, has a command injection flaw in several command endpoints that lets an unauthenticated attacker run arbitrary commands on the appliance. CISA lists it as exploited in the wild.","category":"infrastructure","who_cares":["progress-loadmaster","load-balancer","appliance"],"confidence":0.8,"analyst_note":"Find the affected and fixed LoadMaster versions and the vendor advisory from Progress, and a way to check management interface exposure; the CISA KEV entry does not give them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-loadmaster-deployed"],"severity_if_unknown":"critical"},"cost_usd":0.000383,"input_tokens":2214,"output_tokens":323,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected and fixed LoadMaster versions and the vendor advisory from Progress, and a way to check management interface exposure; the CISA KEV entry does not give them.","search":"'-07':157C,173C '-14':158C,174C '-2026':20A,23A,198C,218C,223C,274C,323C,345C '-8037':21A,24A,219C,275C,346C '-8451':199C,224C,324C '10233f36':335C '14':168C '2026':156C,169C,172C '29':144B,149B '7':153B '7.2.54.17':121B '7.2.63.1':116B '76973ac4':313C 'accessv2':112B 'achiev':293C 'action':306C,308C 'adc':12A,194C,233C,317C 'adjac':270C 'affect':114B,230C 'allow':14A,261C,288C 'also':129B 'api':9A,94B,126B 'apius':108B 'applianc':62B,237C,271C 'application':54A 'attack':247C,291C 'aug':152B 'auth':84B 'authent':18A,207C 'balanc':72B,287C 'block':326C,348C 'caus':97B 'changelog':159C,160C 'chunk':265C 'cisa':150B 'citrix':192C,231C,315C 'cloudflar':63B,166C,310C,332C 'code':5A,209C,295C,341C 'command':2A,86B,279C 'comment':309C 'configur':238C 'connect':131B,133B 'connection':35A,38A,43A,49A 'critic':181C,277C 'cve':19A,22A,197C,217C,222C,273C,321C,322C,343C,344C 'data':268C 'descript':304C 'detect':331C,353C 'disclosur':69B,189C 'ec':130B 'ecs':34A,48A 'enabl':128B 'endpoint':113B 'escap':104B 'execut':6A,210C,296C,342C 'exploit':64B,145B,249C 'find':221C 'firewall':55A 'flaw':190C,251C 'for':40A,45A 'ga':28A,115B 'gateway':196C,236C 'high':203C 'high-sever':202C 'host':81B 'id':300C,303C 'ident':242C 'idp':244C 'improv':164C 'includ':185C 'infrastructur':65B,182C 'inject':3A,87B,280C 'input':227C,319C 'insuffici':226C,318C 'introduc':177C 'juli':167C 'jun':143B,148B 'kemp':26A,30A,66B,92B,215C,284C,338C 'kev':151B 'key':220C 'lab':68B 'lab-disclosur':67B 'leak':264C 'legaci':301C 'load':71B,286C 'load-balanc':70B 'loadmast':78B,93B,216C,285C,339C 'loadmaster':27A,31A,57A,59A,61A 'log':325C,347C 'ltsf':32A,120B 'malform':254C 'manag':132B,134B,311C,333C 'manager':36A,39A,44A,50A 'memori':188C,259C,272C 'miss':100B 'moveit':52A,138B 'n/a':314C,336C 'netscal':193C,232C,235C,316C 'new':161C,178C,307C,330C,352C 'null':101B 'objectscal':136B 'objectscale':41A,46A 'older':118B,123B 'os':1A,85B,278C 'overread':260C 'paramet':109B 'poc':74B,141B 'poc-publ':73B 'pre':83B,206C 'pre-auth':82B 'pre-authent':205C 'previous':305C 'product':13A 'progress':11A,25A,29A,33A,37A,42A,47A,51A,56A,58A,60A,77B,91B,214C,283C,337C 'progress-loadmast':76B 'provid':243C 'public':75B,140B 'quot':105B 'rce':88B,211C,297C 'releas':155C,171C,176C 'remot':4A,208C,245C,290C,294C,340C 'request':255C 'root':95B,96B 'rule':179C,299C,302C 'ruleset':298C,312C,334C 'saml':241C 'seen':146B 'self':80B 'self-host':79B 'send':253C 'sensit':267C 'sever':204C 'target':180C 'termin':102B 'trigger':257C 'un':17A 'un-authent':16A 'unauthent':187C,246C,289C 'updat':162C 'valid':228C,320C 'vulner':7A,183C,212C,229C,281C 'waf':139B,154C,170C 'watchtowr':142B 'web':53A","nicknames":[],"mitigations":[{"kind":"waf-rule","scope":null,"since":"2026-07-14","covers":"HTTP requests proxied through Cloudflare matching the Progress Kemp LoadMaster Remote Code Execution rule (Cloudflare Managed Ruleset, rule ...10233f36), action changed from Log to Block","limits":"none stated","source":"https://developers.cloudflare.com/changelog/post/2026-07-14-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T18:42:46Z","confidence":0.9,"source_title":"WAF Release - 2026-07-14 · Changelog","customer_action":"none stated beyond patching the Kemp LoadMaster; the rule does not replace the upstream fix"}],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-04T14:16:45+00:00","kev":{"dateAdded":"2026-08-07","dueDate":"2026-08-10","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security@progress.com","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2026-8037","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-8037","severity":null,"published_at":"2026-08-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-8037:98","url":null,"severity":null,"published_at":"2026-10-23T21:32:55+00:00","modified_at":"2026-10-23T21:32:55+00:00","first_seen_at":"2026-10-23T21:32:55+00:00","fetched_at":"2026-10-23T21:32:55+00:00","note":"Progress bulletin (June 4) gives affected/fixed versions; watchTowr PoC analysis Jun 29, eSentire saw exploitation from Jun 29, CISA KEV Aug 7. No X chatter. Exact mitigation without upgrade not stated by vendor; MOVEit WAF fixed version only from secondary press (GA 7.2.63.2)."},{"source":"nvd","external_id":"CVE-2026-8037","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8037","severity":null,"published_at":"2026-06-04T14:16:45+00:00","modified_at":"2026-10-15T14:17:29+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-07-14-waf-release/#CVE-2026-8037","url":"https://developers.cloudflare.com/changelog/post/2026-07-14-waf-release/","severity":null,"published_at":"2026-07-14T18:42:44+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","fetched_at":"2026-10-24T18:43:45+00:00","note":"Cloudflare: WAF Release - 2026-07-14 · Changelog"}],"documents":[{"id":1079,"url":"https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691","title":"Progress: LoadMaster Critical Security Bulletin June 2026 (CVE-2026-8037, CVE-2026-33691)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1080,"url":"https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/","title":"watchTowr Labs: Progress Kemp LoadMaster pre-auth RCE CVE-2026-8037","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1083,"url":"https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037","title":"eSentire: exploitation attempts from June 29","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1085,"url":"https://www.cisa.gov/news-events/alerts/2026/08/07/cisa-adds-one-known-exploited-vulnerability-catalog","title":"CISA adds CVE-2026-8037 to KEV, Aug 7 2026","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2878,"url":"https://developers.cloudflare.com/changelog/post/2026-07-14-waf-release/","title":"Cloudflare: WAF Release - 2026-07-14 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-07-14 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nJuly 14, 2026\n\n## WAF Release - 2026-07-14\n\nThis release introduces new rules targeting critical infrastructure vulnerabilities. These include an unauthenticated memory disclosure flaw in Citrix NetScaler ADC and Gateway (CVE-2026-8451) and a high-severity pre-authentication remote code execution (RCE) vulnerability in Progress Kemp LoadMaster (CVE-2026-8037).\n\nKey Findings\n\n- CVE-2026-8451: An insufficient input validation vulnerability affects Citrix NetScaler ADC and NetScaler Gateway appliances configured as a SAML Identity Provider (IdP). Remote, unauthenticated attackers can exploit this flaw by sending malformed requests to trigger a memory overread, allowing them to leak chunks of sensitive data from adjacent appliance memory.\n- CVE-2026-8037: A critical OS command injection vulnerability in Progress Kemp LoadMaster load balancers allows unauthenticated remote attackers to achieve remote code execution (RCE).\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...76973ac4 | N/A | Citrix Netscaler ADC - Insufficient Input Validation - CVE:CVE-2026-8451 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...10233f36 | N/A | Progress Kemp LoadMaster - Remote Code Execution - CVE:CVE-2026-8037 | Log | Block | This is a new detection. |","published_at":"2026-07-14T18:42:44+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}