CVE-2026-8037Active Exploitation(progress / connection_manager_for_objectscale)

We're back, analyzing CVE-2026-8037, a pre-auth RCE in Progress' Kemp LoadMaster appliance. https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/ Speak soon...

🚨 Attackers are exploiting a LoadMaster flaw for command execution. CVE-2026-8037 lets unauthenticated attackers run arbitrary commands on affected appliances. KEVIntel logged 792 exploitation attempts from 65 IPs in 41 days. What defenders need to know: https://thehackernews.com/2026/08/progress-kemp-loadmaster-flaw-hits-cisa.html

🚨 ALERT - Attackers are trying to exploit CVE-2026-8037 in Progress Kemp LoadMaster. The CVSS 9.6 flaw enables unauthenticated OS command injection and arbitrary code execution on vulnerable appliances. eSentire says the attempts it saw failed, but PoC details are now public. Read: https://thehackernews.com/2026/07/latest-progress-kemp-loadmaster-pre.html

⚠️ Public PoC is out for CVE-2026-8037, a critical Progress Kemp LoadMaster API flaw. It lets unauthenticated attackers run root commands when the API is enabled. Patch now. Restrict API exposure. Full story: https://thehackernews.com/2026/06/progress-kemp-loadmaster-flaw-could-let.html

CISAが1日で重大警告を叩きつけてきた。 北朝鮮がオフラインでAIを回し攻撃精度を上げている横で、 国内のデータセンターがランサムウェアで止まった日だ。 ・LoadMaster CVE-2026-8037（CVSS 9.6）、悪用確認——即時パッチ指示 ・Gunra RaaS AA26-222A、CISA/FBI/NSA合同——政府・重要インフラ標的 ・北朝鮮Kimsuky、オフラインAI構築——フィッシングとマルウェアを自動生成 ・シーイーシー東京第二DC、ランサムウェア被害確認——個情委報告済み 今日の4件、自分の現場に重ねて読んだか。 CISAの警告を「欧米の話」と流し、委託先のセキュリティを信頼だけで丸投げしているなら—— その隙間が今夜の侵入口になる。君のパッチ対応は何日遅れている？

🛡️We added Progress LoadMaster command injection #RCE vulnerability CVE-2026-8037 to our KEV Catalog. Visit http://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/TA0sO5OPcr

Pre-Auth RCE in Progress Kemp LoadMaster @watchtowrcyber has published an in-depth technical analysis of CVE-2026-8037 — a pre-auth remote code execution vulnerability in the API component of the Progress Kemp LoadMaster load balancer. PT ID: PT-2026-46231 Entry point: │ POST /accessv2 HTTP/1.1 │ Accept-Encoding: gzip, deflate, br │ Content-Length: 2986 │ Host: 192.168.5.30:443 │ Content-Type: application/json │ Accept: */* │ Connection: keep-alive │ │ {"cmd": "getall", "apiuser": "AAAAAA", "apipass": "BBBBBB"} In vulnerable versions ("GA v7.2.63.1" and earlier, "LTSF v7.2.54.17" and earlier), the function "escape_quotes()" in "/accessv2": - allocates a buffer via "malloc()", and the memory is not zero-initialized - does not append "\0" to the resulting string, allowing reads beyond the buffer boundary. As a result, supplying the payload ""apiuser":"''''"" leads to full pre-auth remote code execution as root on a device typically exposed at the network perimeter. The issue was fixed in version "7.2.63.2" and later. The patch replaced "malloc" with "calloc" and added "*end = 0", eliminating the use of uninitialized memory and preventing data leakage. Article: https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/ #dbugs_attacks

⚠️ Kemp LoadMaster CVE-2026-8037 is a pre-auth OS command injection flaw. @eSentire saw exploitation attempts, but said the observed attempts failed and no post-compromise activity occurred. PoC and technical details are public. https://x.com/TheHackersNews/status/2072319026856927325

Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037) - watchTowr Labs https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/

[ZDI-26-340|CVE-2026-8037] Progress Software Kemp LoadMaster dodelapikey Uninitialized Memory Remote Code Execution Vulnerability (CVSS 8.8; Credit: Syed Ibrahim Ahmed of TrendAI Research) https://www.zerodayinitiative.com/advisories/ZDI-26-340/

Rapid reaction gets you ahead. 39 days before CISA added CVE-2026-8037 Remote Code Execution in Progress Kemp LoadMaster to KEV, watchTowr clients were aware of their exposure. Reach out via our website if you need support. https://t.co/P7DMRghEHS

⚠️ New Actively-Exploited Vulnerability • CVE: CVE-2026-8037 • Vendor: Progress • Product: LoadMaster • Command injection allows arbitrary command execution • Actively exploited in the wild, not linked to ransomware Apply mitigations by 2026-08-10. Full report: 🔗 https://darkfeed.io #LoadMaster #CyberSecurity #CISA

米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（08/07追加） #vulnerability 🛡CVE-2026-8037 Progress LoadMaster Command Injection Vulnerability ✅概要 ・深刻度：緊急 9.8 (CVSS Base) / NVD ・種別：コマンドインジェクション (CWE-77) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Progress LoadMaster、ECS Connection Manager、Object Scale Connection Manager、MOVEit WAF に存在する OS コマンドインジェクションの脆弱性です。 未認証の攻撃者が、複数のコマンドエンドポイントにおけるサニタイズ不備を悪用し、LoadMaster アプライアンス上で任意コマンドを実行できる可能性があります。 影響を受ける LoadMaster は GA 7.2.63.1 以前、および LTSF 7.2.54.17 以前であり、修正バージョンは GA 7.2.63.2 および LTSF 7.2.54.18 です。 ✅ChatGPTによる脆弱性評価 ・国内影響度：高 ・悪用難易度：低 ✅CISA 評価 ・攻撃自動化：自動化は困難 ・技術的影響：完全制御 ・BOD 26-04 対処期限（露出あり）：2026年8月10日 ・BOD 26-04 対処期限（露出なし）：2026年8月21日 ✅攻撃前提条件 ・Progress LoadMaster、ECS Connection Manager、Object Scale Connection Manager、または MOVEit WAF を使用している ・LoadMaster GA 7.2.63.1 以前、または LTSF 7.2.54.17 以前を使用している ・攻撃者が対象製品の API エンドポイントへネットワーク経由でアクセスできる ・攻撃者は認証情報を必要としない ・API が有効化されている ・修正済みバージョンへ更新されていない ✅悪用時影響 ・未認証の攻撃者に任意コマンドを実行される可能性がある ・LoadMaster アプライアンス上でリモートコード実行につながる可能性がある ・root 権限相当でコマンドを実行される可能性がある ・ロードバランサーやADCを起点に内部ネットワークへの追加侵害につなげられる可能性がある ・機密性、完全性、可用性に高い影響が生じる ✅悪用事例等に関する公開情報 ・PoC/Exploit：公開済み ・ITW：確認済み（eSentire） ・概要：eSentire Threat Response Unit は、2026年6月29日から CVE-2026-8037 を標的とする悪用試行を確認したと公表 ✅関連情報 ・https://nvd.nist.gov/vuln/detail/CVE-2026-8037 ・https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691 ・https://docs.progress.com/bundle/release-notes_loadmaster-7-2-63-2/page/Security-Updates.html ・https://docs.progress.com/bundle/release-notes_loadmaster-7-2-54-18/page/Security-Updates.html ・https://github.com/cisagov/vulnrichment/blob/develop/2026/8xxx/CVE-2026-8037.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037 ・https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/ ・https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037 ・https://jvndb.jvn.jp/ja/cwe/CWE-77.html CISA Alert ・https://www.cisa.gov/news-events/alerts/2026/08/07/cisa-adds-one-known-exploited-vulnerability-catalog #vulnerability

🚨 CVE-2026-8037 - critical 🚨 Progress ADC LoadMaster - Command Injection > OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Produ... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-8037 @pdnuclei #NucleiTemplates #cve

🚨 Upozorňujeme na RCE zranitelnost v Progress Kemp LoadMaster, CVE-2026-8037. Zranitelnost typu pre-authentication Remote Code Execution (RCE) umožňuje neautentizovanému útočníkovi s přístupem k síti zneužít rozhraní LoadMaster API (/accessv2) a spustit libovolné shell příkazy na zasaženém zařízení. Příčinou je chyba v práci s neinicializovanou pamětí a nesprávné ukončení řetězců při zpracování vstupu v API. Vzhledem k tomu, že LoadMaster je typicky umístěn na perimetru sítě, může úspěšné zneužití vést k získání počátečního přístupu do infrastruktury organizace a potenciálně až k jejímu úplnému kompromitování. Zranitelné jsou verze GA v7.2.63.1 a starší a LTSF v7.2.54.17 a starší, a to pouze pokud je aktivní LoadMaster API. 📌Doporučujeme aktualizovat na verze Progress Kemp LoadMaster GA v7.2.63.2 nebo LTSF v7.2.54.18, případně novější.

🚨 Patch Now | August 25, 2026 Bringing these vulnerabilities to your attention. Today is the CISA deadline for ShieldBreak (CVE-2026-68820). - Dahua cameras Vulnerability - Progress LoadMaster (CVE-2026-8037) https://cert.ug | #CyberSafeUG #CERTUGCC https://t.co/QPPSjtgtm0

This critical flaw is already on CISA’s exploited list. Cyber Pulse 🛡️🦅 CISA has added a critical Progress Kemp LoadMaster vulnerability CVE-2026-8037 to its Known Exploited Vulnerabilities catalog. Attackers can achieve remote code execution on unpatched devices. If your organisation uses Kemp LoadMaster, patch immediately. How fast does your team usually act when something hits the CISA KEV list? #CyberSecurity #ZeroDay #CurrentThreats

Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037) - watchTowr Labs https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/

🚨 CVE-of-the-Day: CVE-2026-8037 — Progress Kemp LoadMaster, pre-auth RCE CVSS: 9.6 | EPSS: High (public PoC) An unauthenticated attacker can run commands as root on this edge load balancer. Actively exploited — 792+ attempts reported. Why it matters: LoadMaster sits at the network edge, routing traffic to backend servers. A memory bug in its API's input sanitizer turned into unauthenticated command injection — root on the appliance itself, with no login. Edge devices like this are the way in, not just a gate. Status: Actively exploited — added to CISA KEV on Aug 7 with a Aug 10 (today) federal remediation deadline. Disclosed in June, public PoC and exploit attempts followed within weeks; eSentire first spotted probing back on June 29. Fix it: Upgrade to LoadMaster GA 7.2.63.2 or LTSF 7.2.54.18 now (patched since June). Can't patch today? Restrict the management API to trusted networks, or disable it if you don't need it. #LoadBalancer #EdgeSecurity #CVE #infosec #Kemp

1/3 CVE-2026-8037 (CVSS 9.6) in Progress Kemp LoadMaster is under active exploitation. Unauthenticated attackers can inject OS commands and execute code on the device. eSentire saw exploitation activity starting June 29. Patch immediately. #CVE #RCE #cybersecurity #LoadMaster