CVE-2026-8037

Name of the Vulnerable Software and Affected Versions Progress Kemp LoadMaster versions GA v7.2.63.1 and earlier Progress Kemp LoadMaster versions LTSF v7.2.54.17 and earlier MOVEit WAF versions prior to GA v7.2.63.2 Progress ECS Connection Manager (affected versions not specified) Progress Object Scale Connection Manager (affected versions not specified)

Description An OS command injection flaw in the API of Progress ADC products allows an unauthenticated remote attacker to execute arbitrary commands as root on the LoadMaster appliance. The issue stems from unsanitized input in multiple command endpoints. Specifically, the escape quotes() function in the /accessv2 endpoint uses malloc() instead of calloc(), resulting in uninitialized heap memory, and fails to append a null terminator to the output string. This allows an attacker to read past the buffer boundary and inject shell commands into a system() call via the apiuser variable. Over 100,000 deployments are estimated worldwide, and active exploitation has been observed, including nearly 300 instances exposed online.

Recommendations Update Progress Kemp LoadMaster GA to version 7.2.63.2 or later. Update Progress Kemp LoadMaster LTSF to a version containing the fix. Update MOVEit WAF to version GA v7.2.63.2 or later. As a temporary mitigation, restrict access to the /accessv2 API endpoint or disable the API if not required.