CVE-2026-8037

Progress · Published June 4, 2026

9.8

CVSS v3.1

CRITICAL

CISA KEV — Federal agencies must patch by deadline

Actively exploited in the wild

Patch availableGet patch

Description

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

Affected Products

Connection Manager FOR Objectscale < 7.2.63.2
ECS Connection Manager < 7.2.63.2
Loadmaster < 7.2.54.18
Loadmaster < 7.2.63.2

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H