Progress LoadMaster Command Injection Vulnerability: CVE-2026-8037
- Severity
- HIGH
- Affected component
- progress loadmaster (npm)
- Patched version
- Not yet available
A critical command injection vulnerability in Progress LoadMaster (CVE-2026-8037) is being actively exploited. Users of Progress LoadMaster are advised to upgrade immediately.
What happened
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that a critical-severity command injection vulnerability in Progress LoadMaster (CVE-2026-8037) is being actively exploited in the wild. This flaw allows unauthenticated attackers to execute arbitrary commands on unpatched LoadMaster appliances by exploiting unsanitized input in multiple command endpoints. According to CISA, the vulnerability stems from improper handling of user-supplied input in a function named 'escape_quotes()' within the load balancer application.
CISA has observed 792 exploitation attempts over the last 41 days from 65 unique IP addresses across 18 countries. The attacks originated from specific IP addresses, indicating targeted exploitation efforts. Progress Software reports that 80% of Fortune 500 companies use its products, with Kemp LoadMaster having over 100,000 deployments worldwide.
What to do about it
- Upgrade to the latest version of Progress LoadMaster immediately.
- Review all command inputs for potential injection points.
- Monitor the primary sources for updates on the vulnerability and any available patches.
- Implement additional security measures to detect and prevent command injection attempts.
How 0Day would have caught this
progress loadmaster is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Progress LoadMaster, you may be affected by this vulnerability. Check the official sources for more information on affected versions.
What should I do right now?
Upgrade to the latest version of Progress LoadMaster and review all command inputs for potential injection points.
Has this been exploited in the wild?
Yes, this vulnerability is being actively exploited in the wild.