Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2026-8037

CriticalExploitedPublic exploit

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

Published Jun 4, 2026 · Updated Oct 15, 2026

Key Facts

Patch immediately
  • CVE-2026-8037 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Connection Manager For Objectscale (Progress), Ecs Connection Manager (Progress), Moveit Web Application Firewall (Progress) and 4 more products.
  • It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jul 1, 2026. Public exploit code is available.
  • EPSS estimates a 77% probability of exploitation in the next 30 days.
  • Fixed versions are available, including ECS Connections Manager V7.2.63.2, LoadMaster V7.2.54.18, LoadMaster V7.2.63.2.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

77%

Higher than 99.5% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2026-8037 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CISA KEVAug 7, 2026Aug 10, 2026Not reported
Industry KEV feedJul 1, 2026Aug 10, 2026Not reported
CIRCL KEVJul 1, 2026Aug 10, 2026Not reported
ENISA EUVDAug 7, 2026n/aNot reported

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Products

8 affected entries in total
ProductAffected versionsFixed in
Connection Manager For ObjectscaleProgressSee advisory7.2.63.2
Ecs Connection ManagerProgressSee advisory7.2.63.2
Moveit Web Application FirewallProgressSee advisory7.2.63.2
LoadMasterProgress>= V7.2.60.07.2.54.18
ECS Connections Manager>= V7.2.60.0V7.2.63.2
2 more affected products in the full CVE brief

Patched Releases

ECS Connections Manager

V7.2.63.2

LoadMaster

V7.2.54.18, V7.2.63.2, 7.2.54.18, 7.2.63.2

MOVEit WAF

V7.2.63.2

Object Scale Connection Manager

V7.2.63.2

Connection Manager For Objectscale

7.2.63.2

Ecs Connection Manager

7.2.63.2

Moveit Web Application Firewall

7.2.63.2

Timeline

  1. Publicly disclosed

    Jun 4, 2026

  2. Added to Industry KEV feed

    Jul 1, 2026

  3. Added to CIRCL KEV

    Jul 1, 2026

  4. Added to CISA KEV

    Aug 7, 2026

  5. Added to ENISA EUVD

    Aug 7, 2026

  6. Last updated

    Oct 15, 2026

Weakness Type

  • CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

References

9 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2026-8037 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo