Critical Actively exploited

CVE-2026-8037

Progress LoadMaster Command Injection Vulnerability

What this means

Weakness: Unfiltered input is concatenated into a command, letting the attacker append their own.
Likelihood: Exploitation is not hypothetical: CISA has observed it in the wild.

What to doTop priority: CISA sets the remediation deadline at 10 August 2026.

Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.

Published: 7 August 2026
CVSS: —
EPSS: 99.57% probability of exploitation within 30 days · above 100% of all CVEs
Weakness: CWE-77
CISA due date: 10 August 2026 past due
Sources: cisa-kev

Our analysis Progress LoadMaster Hit by Critical Command Injection — 100,000 Deployments Exposed, 80% of Fortune 500 Affected

References

https://nvd.nist.gov/vuln/detail/CVE-2026-8037