LIVE · cybersecurity feed
Live wire
ASOS Breach Reveals the Risks in Customer-Facing SaaSUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoAI Training Critical as Governance Challenges GrowUS Disrupts Chinese State-Sponsored Hacking ToolsCitrix warns admins to patch new NetScaler RCE flaw immediatelyCisco Patches a Dozen Critical VulnerabilitiesCisco warns of critical flaws allowing Nexus switch takeoverCVE-2026-21589 · Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Cyber experts call on CISA to create mandatory federal OT rulesGremlin Foresight AI finds system weaknesses and verifies the fixes
cve recordcriticalexploited in the wild3 of 3 cataloguesexploit reported

CVE-2026-8037

Progress · LoadMaster · Progress LoadMaster Command Injection Vulnerability

Published · Added to CISA KEV
CVSS9.6
Severitycritical
WeaknessCWE-77
EPSS77.4%99.6th percentile
Exploited3 KEV sources
Ransomware useUnknown
Federal fix dueAug 10, 2026

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

patch window

Called exploited 27 days after disclosure.

Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.

The life of this vulnerability

  1. CVE published
  2. First KEV listing27d
  3. Last KEV listing37d
  4. Last sighting26d

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

Sources3 of 3
Listings differ by37 d
Strongest claimconfirmed

3 catalogues list it. CIRCL aggregates the others and is shown but not counted.

Public exploitation evidence

15 public reports collected from VulnCheck and CIRCL, first on Jul 1, 2026. Each links to its original source. We have not verified them.

Description

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

Required action (CISA)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

← Back to the CVE Tracker

Our coverage of CVE-2026-8037

CVE-2026-8037critical

CISA Adds Progress LoadMaster Command Injection Flaw to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Progress LoadMaster products, identified as CVE-2026-8037, to its Known Exploited Vulnerabilities (KEV) catalog. This addition mandates that federal agencies address the flaw by August 10, 2026.

CVE-2026-8037critical

Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts

A critical command injection vulnerability affecting Progress Kemp LoadMaster has been added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog. The flaw, identified as CVE-2026-8037, reportedly enables unauthenticated attackers to achieve arbitrary code execution on vulnerable devices. This inclusion by CISA follows reports of…

CVE-2026-46817high

Ransomware Attacks Hit Financial, Defense, and Manufacturing Firms

Several organizations across the financial, defense, and manufacturing sectors have recently disclosed ransomware attacks or data breaches. These incidents include a US financial institution, a Spanish defense contractor, a Japanese industrial manufacturer, and a US insurance firm's Japanese operations.