CVE-2026-8037 | THREATINT

Description

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

PUBLISHED Reserved 2026-05-06 | Published 2026-06-04 | Updated 2026-06-05 | Assigner ProgressSoftware

CRITICAL: 9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Problem types

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

Product status

Default status

unaffected

V7.2.60.0 (custom) before V7.2.63.2

affected

V7.2.45.12 (custom) before V7.2.54.18

affected

Default status

unaffected

V7.2.60.0 (custom) before V7.2.63.2

affected

Default status

unaffected

V7.2.60.0 (custom) before V7.2.63.2

affected

Default status

unaffected

V7.2.60.0 (custom) before V7.2.63.2

affected

Credits

Jacky Yang and Syed Ibrahim Ahmed of TrendAI Research finder

References

community.progress.com/...-2026-CVE-2026-8037-CVE-2026-33691 vendor-advisory

cve.org (CVE-2026-8037)

nvd.nist.gov (CVE-2026-8037)

Download JSON