Protego field desk
PROTEGO
← CVE Lookup

CVE-2026-8037

CRITICALCVSS 3.1 · 9.8 · NIST NVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

CISA KEV: known exploited

Added: 2026-08-07 · Due: 2026-08-10

Known ransomware use: Unknown

EPSS: 99.84% · Percentile: 100.0%

As of 2026-10-27

EPSS estimates exploitation probability over the next 30 days. KEV due dates apply to US federal civilian agencies. Confirm your affected versions in vendor advisories.

CWE: CWE-77 · Published: 2026-06-04T14:16:45.177 · Modified: 2026-10-15T14:17:29.840

Sources: NIST NVD, CISA KEV, FIRST EPSS. NVD and EPSS cached up to 6 hours; KEV up to 12 hours.

All CVSS assessments
  • CVSS 3.1: 9.8 (CRITICAL) · NIST NVD
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVSS 3.1: 9.6 (CRITICAL) · security@progress.com
    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References and fixes