CRITICALCVSS 9.6Actively exploited · CISA KEV since 2026-08-07Vulnerability

CVE-2026-8037

Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.

Properties

Euvd product
LoadMaster, ECS Connections Manager, MOVEit WAF, Object Scale Connection Manager
Vulnerability name
Progress LoadMaster Command Injection Vulnerability
First seen
2026-10-15T13:20:45+00:00
Cvss score
9.6
Epss score
0.99794
Last seen
2026-10-19T12:00:27+00:00
Due date
2026-08-10
Euvd assigner
ProgressSoftware
Retrieved at
2026-11-06T06:20:24+00:00
Exploited euvd since
2026-08-07T00:00:00+00:00
Src batch id
euvd-20261101T073402Z-2b43cb
Source url
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-34260
Date added
2026-08-07
Euvd base score version
3.1
Score
9.6
Fetched at
2026-11-01T07:34:02+00:00
Euvd vendor
Progress Software
Cvss vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
In Signal since
initial import (Sep 2026)
Euvd base score
9.6

Related Entities (7)

AFFECTS_PRODUCT (4)

→[Product]progress ecs connection manager
→[Product]progress connection manager for objectscale
→[Product]progress loadmaster
→[Product]progress moveit web application firewall

DESCRIBES (1)

←[KEVEntry]Progress LoadMaster Command Injection Vulnerability

HAS_WEAKNESS (1)

→[Weakness]Improper Neutralization of Special Elements used in a Command ('Command Injection')

INVOLVES (1)

←[Signal]kev_added · 2026-08-07

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2026-8037 (CVSS 9.6) — Ninja Signal Threat Intelligence | Ninja Signal