Progress LoadMaster Command Injection — exploitable from the network with no login

What it is

Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.

Why it matters

• CISA added it to the Known Exploited Vulnerabilities catalogue on August 7, 2026 — that is observed exploitation, not a prediction.
• EPSS puts the chance of exploitation in the next 30 days at 99.6% — the top 0.1% of all scored CVEs.
• CVSS 9.8 (critical), and it is reachable over the network, needs no credentials, needs no user interaction.

What to do

• Patch it. CISA's deadline for federal agencies was August 10, 2026 and has already passed.
• Check Progress's advisory for affected versions: https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691

---

Drafted from CVE-2026-8037 as held by CISA KEV, NVD and FIRST EPSS. Check it before it ships.