CVE-2026-8037

Published Jun 4, 2026

Last updated 2 days ago

CVSS critical 9.6
API

Overview

Description
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
Source
security@progress.com
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.6
Impact score
6
Exploitability score
2.8
Vector string
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

security@progress.com
CWE-77

Social media

Hype score
Not currently trending

  1. Legacy exposure keeps paying off for attackers. Progress Kemp LoadMaster CVE-2026-8037 exploitation moves… Attackers are targeting CVE-2026-8037, a critical pre-auth command injection flaw in Progre… 🔗 Read → https://t.co/FpD8k42ZQl

    @fynn_JourX

    2 Jul 2026

    36 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. ⚠️ Vulnerabilidad en productos Progress ❗ CVE-2026-8037 ❗ CVE-2026-33691 ➡️ Más info: https://t.co/SPwHWmm3cm https://t.co/JlAMWbyS2X

    @CERTpy

    19 Jun 2026

    77 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. 【Progress Kemp LoadMasterに未認証RCE脆弱性】 Progress Kemp LoadMasterに、CVE-2026-8037とCVE-2026-33691の2件の脆弱性が公表されました。CVE-2026-8037はAPIの入力検証不備に起因するOSコマンドインジェクションで、認証なしに任

    @01ra66it

    7 Jun 2026

    327 Impressions

    2 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Progress issued a LoadMaster security bulletin on two flaws CVE-2026-8037 and CVE-2026-33691 disclosed in June 2026, according to Canada's Cyber Centre. https://t.co/NOPtr7ylqT

    @threatcluster

    6 Jun 2026

    56 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the input does not alter the scheme, host, or user info, it relies on ResolveReference for the final URL resolution. Because dot segments (../) are normalized during this resolution step, an attacker can supply path parameters containing directory traversal sequences to escape the operator-configured path scope. This allows the client to coerce the toolbox into making requests to unintended endpoints on the same target host while forwarding the toolbox's configured credentials (e.g., bypassing a restricted path like /api/v1/users/{{.id}} to reach /admin/secrets).•CVE-2026-11720
  2. Nx Console Embedded Malicious Code Vulnerability•CVE-2026-48027
  3. Microsoft Defender Denial of Service Vulnerability•CVE-2026-45498
  4. Microsoft Defender Link Following Vulnerability•CVE-2026-41091
  5. WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Attackers can upload PHP files with arbitrary names to the config_file endpoint to achieve remote code execution on the server.•CVE-2021-47933

References

Sources include official advisories and independent security research.