Progress LoadMaster: pre-authentication command injection (CVE-2026-8037)

Unauthenticated command injection in LoadMaster appliances, CVSS 9.8, listed in CISA KEV. Apply the Progress fix.

On 4 June 2026 the record for CVE-2026-8037 was published, an unauthenticated command injection in Progress LoadMaster appliances, with an NVD CVSS v3.1 score of 9.8. An attacker can run operating system commands through API endpoints that do not sanitise input.

The vulnerability is in CISA's KEV catalogue. Progress published its June 2026 security bulletin, which covers it together with CVE-2026-33691.

Apply the Progress fix and make sure the appliance management interface is not reachable from the internet. Also review access logs of the API endpoints for anomalous activity.

At a glance

What: Operating system command execution on Progress LoadMaster appliances, without authentication, through API endpoints.
Severity: CVSS v3.1 9.8 (critical), according to NVD. Progress reports 9.6 with a different vector.
Cause: Unsanitised input in command endpoints (CWE-77).
Status: Listed in the CISA KEV catalogue, so reported as actively exploited.
Action: Apply the Progress bulletin of June 2026 and make sure the management interface is not exposed to the internet.

Sources: NVD, CVE-2026-8037 · Progress, bollettino LoadMaster giugno 2026 · CISA, catalogo KEV

← All articles