OS Command Injection Flaw in Progress ADC Products
CVE-2026-8037

9.6CRITICAL

Key Information:

Vendor

Progress Software
Status
Loadmaster
Ecs Connections Manager
Object Scale Connection Manager
Moveit Waf
Vendor
CVE Published:
4 June 2026

What is CVE-2026-8037?

An OS command injection vulnerability exists in the API of Progress ADC Products, specifically affecting the LoadMaster appliance. This vulnerability allows unauthenticated attackers to execute arbitrary commands through unsanitized input in multiple command endpoints. Exploiting this weakness could lead to serious security breaches, potentially compromising the integrity and functionality of the device.

Affected Version(s)

ECS Connections Manager V7.2.60.0

LoadMaster V7.2.60.0

LoadMaster V7.2.45.12

References

https://community.progress.com/s/article/LoadMaster-Criti...
vendor-advisory

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jacky Yang and Syed Ibrahim Ahmed of TrendAI Research
.