CVE.RADIO
FREN

CVE-2026-8037

Progress LoadMasterActively Exploited (CISA KEV)CVSS 9.6KEV0-DayPoC

Actively exploited (CISA KEV) - patch before 2026-08-10

Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.

Actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No distribution fix is listed yet; apply vendor mitigations and monitor.

Recommended action: No fix is published yet for an actively-exploited flaw. Apply vendor mitigations, restrict exposure, and watch for a patch.

CVE-2026-8037 Progress LoadMaster Actively Exploited (CISA KEV)

Severity metrics

CVSS 3.1 : 9.6 CRITICAL

Attack vectorAdjacent network
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh

Vector: AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected & fixed versions by distribution

Versions are the native distribution strings (backport-aware): RHEL/Debian/SUSE backport fixes, so compare with the distro version comparator (dpkg / rpm / vercmp), not the upstream version.

No affected package in the tracked watchlist yet (Debian, Ubuntu, Arch, SUSE, Red Hat...). Triage may still be pending.

Sources

Advisory NVD CVE.org

Other vulnerabilities in Progress LoadMaster

Published 2026-08-07 · source: CISA Known Exploited Vulnerabilities