--- id: "CVE-2026-8037" kind: "vulnerability" aliases: ["CVE-2026-8037"] title: "OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated\u2026" severity: "critical" cvss: 9.8 epss: null exploited: true status: "resolved" category: "infrastructure" products: [{"name": "Progress Kemp LoadMaster GA", "fixed": ["7.2.63.2"], "affected": "<= 7.2.63.1", "ecosystem": "vendor"}, {"name": "Progress Kemp LoadMaster LTSF", "fixed": ["7.2.54.18"], "affected": "<= 7.2.54.17", "ecosystem": "vendor"}, {"name": "Progress ECS Connection Manager", "fixed": ["7.2.63.2"], "affected": "<= 7.2.63.1", "ecosystem": "vendor"}, {"name": "Progress Connection Manager for ObjectScale", "fixed": ["7.2.63.2"], "affected": "<= 7.2.63.1", "ecosystem": "vendor"}, {"name": "progress connection manager for objectscale", "fixed": ["7.2.63.2"], "affected": "< 7.2.63.2", "ecosystem": "vendor"}, {"name": "progress ecs connection manager", "fixed": ["7.2.63.2"], "affected": "< 7.2.63.2", "ecosystem": "vendor"}, {"name": "progress moveit web application firewall", "fixed": ["7.2.63.2"], "affected": "< 7.2.63.2", "ecosystem": "vendor"}, {"name": "progress loadmaster", "fixed": ["7.2.54.18"], "affected": "< 7.2.54.18", "ecosystem": "vendor"}, {"name": "progress loadmaster", "fixed": ["7.2.63.2"], "affected": ">= 7.2.55.0, < 7.2.63.2", "ecosystem": "vendor"}, {"name": "Progress LoadMaster", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["appliance", "cloudflare", "exploited", "infrastructure", "kemp", "lab-disclosure", "load-balancer", "poc-public", "progress-loadmaster", "self-hosted"] not_affected_if: ["api-disabled", "no-loadmaster-deployed", "patched-7.2.63.2"] published_at: "2026-06-04T14:16:45+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-24T18:43:45+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-8037", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:32:55+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8037", "first_seen_at": "2026-10-23T23:44:51+00:00"}, {"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-07-14-waf-release/", "first_seen_at": "2026-10-24T18:43:45+00:00"}] --- # OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated… Pre-auth OS command injection / RCE in the Progress Kemp LoadMaster API (root; root cause is a missing null terminator in escape_quotes() on the apiuser parameter of the accessv2 endpoint). Affects GA 7.2.63.1 and older and LTSF 7.2.54.17 and older when the API is enabled. Also ECS Connection Manager, Connection Manager for ObjectScale and MOVEit WAF. Public PoC (watchTowr, Jun 29); exploitation seen from Jun 29; CISA KEV Aug 7. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Progress Kemp LoadMaster GA affected <= 7.2.63.1 fixed 7.2.63.2 - vendor:Progress Kemp LoadMaster LTSF affected <= 7.2.54.17 fixed 7.2.54.18 - vendor:Progress ECS Connection Manager affected <= 7.2.63.1 fixed 7.2.63.2 - vendor:Progress Connection Manager for ObjectScale affected <= 7.2.63.1 fixed 7.2.63.2 - vendor:progress connection manager for objectscale affected < 7.2.63.2 fixed 7.2.63.2 - vendor:progress ecs connection manager affected < 7.2.63.2 fixed 7.2.63.2 - vendor:progress moveit web application firewall affected < 7.2.63.2 fixed 7.2.63.2 - vendor:progress loadmaster affected < 7.2.54.18 fixed 7.2.54.18 - vendor:progress loadmaster affected >= 7.2.55.0, < 7.2.63.2 fixed 7.2.63.2 - vendor:Progress LoadMaster affected ? fixed ? ## How to check Web UI: the version string is top-right (or the console at boot). Vulnerable if GA <= 7.2.63.1 or LTSF <= 7.2.54.17 AND the API is enabled (check Certificates & Security > Remote Access / enable API interface in the web UI). Check whether the management UI/API is reachable from untrusted networks, and review logs for requests to the accessv2 endpoint with quote characters in apiuser. Vendor says no known IOCs. ## Fix Upgrade to GA 7.2.63.2 or later, or LTSF 7.2.54.18 or later (ECS Connection Manager and Connection Manager for ObjectScale 7.2.63.2). Disable the API and restrict management access to trusted networks until patched. Review for prior compromise, since exploitation began in June. ## Mitigated for you by - Cloudflare (waf-rule, since 2026-07-14): covers HTTP requests proxied through Cloudflare matching the Progress Kemp LoadMaster Remote Code Execution rule (Cloudflare Managed Ruleset, rule ...10233f36), action changed from Log to Block Limits: none stated Still: none stated beyond patching the Kemp LoadMaster; the rule does not replace the upstream fix https://developers.cloudflare.com/changelog/post/2026-07-14-waf-release/ ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-8037 - 2026-10-23T21:32:55+00:00 analyst — Progress bulletin (June 4) gives affected/fixed versions; watchTowr PoC analysis Jun 29, eSentire saw exploitation from Jun 29, CISA KEV Aug 7. No X chatter. Exact mitigation without upgrade not stated by vendor; MOVEit WAF fixed version only from secondary press (GA 7.2.63.2). - 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-8037 - 2026-10-24T18:43:45+00:00 lab https://developers.cloudflare.com/changelog/post/2026-07-14-waf-release/ — Cloudflare: WAF Release - 2026-07-14 · Changelog ## Documents - [advisory] Progress: LoadMaster Critical Security Bulletin June 2026 (CVE-2026-8037, CVE-2026-33691) https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691 - [advisory] Cloudflare: WAF Release - 2026-07-14 · Changelog https://developers.cloudflare.com/changelog/post/2026-07-14-waf-release/ - [describes] eSentire: exploitation attempts from June 29 https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037 - [describes] CISA adds CVE-2026-8037 to KEV, Aug 7 2026 https://www.cisa.gov/news-events/alerts/2026/08/07/cisa-adds-one-known-exploited-vulnerability-catalog - [poc] watchTowr Labs: Progress Kemp LoadMaster pre-auth RCE CVE-2026-8037 https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/ ## From the sources WAF Release - 2026-07-14 · Changelog # Changelog New updates and improvements at Cloudflare. July 14, 2026 ## WAF Release - 2026-07-14 This release introduces new rules targeting critical infrastructure vulnerabilities. These include an unauthenticated memory disclosure flaw in Citrix NetScaler ADC and Gateway (CVE-2026-8451) and a high-severity pre-authentication remote code execution (RCE) vulnerability in Progress Kemp LoadMaster (CVE-2026-8037). Key Findings - CVE-2026-8451: An insufficient input validation vulnerability affects Citrix NetScaler ADC and NetScaler Gateway appliances configured as a SAML Identity Provider (IdP). Remote, unauthenticated attackers can exploit this flaw by sending malformed requests to trigger a memory overread, allowing them to leak chunks of sensitive data from adjacent appliance memory. - CVE-2026-8037: A critical OS command injection vulnerability in Progress Kemp LoadMaster load balancers allows unauthenticated remote attackers to achieve remote code execution (RCE). | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | --- | --- | --- | --- | --- | --- | --- | | Cloudflare Managed Ruleset | ...76973ac4 | N/A | Citrix Netscaler ADC - Insufficient Input Validation - CVE:CVE-2026-8451 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...10233f36 | N/A | Progress Kemp LoadMaster - Remote Code Execution - CVE:CVE-2026-8037 | Log | Block | This is a new detection. | --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_