VulnScan

OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

Note: This data is for reference and cybersecurity research purposes only.CyStack advises users not to use this information for unlawful purposes.

What is CVE-2026-8037?

CVE-2026-8037 is a vulnerability classified as Improper Neutralization of Special Elements used in a Command ('Command Injection'), affecting LoadMaster (affected versions: V7.2.60.0 – < V7.2.63.2 and V7.2.45.12 – < V7.2.54.18), ECS Connections Manager (affected versions: V7.2.60.0 – < V7.2.63.2), Object Scale Connection Manager (affected versions: V7.2.60.0 – < V7.2.63.2), and 1 more product. This vulnerability is rated Critical, with a CVSS score of 9.6. This vulnerability has been observed being exploited in the wild.

Analyzing data...

Overview

Original source data

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

Affected products and scope

Analyzing data...

Technical details

Analyzing data...

Exploitability

Analyzing data...

Technical impact

Analyzing data...

Business impact

Analyzing data...

Remediation

Analyzing data...

Detection

Analyzing data...
Sources (8)
GCVE / Vulnerability-Lookup
CVE Program
FIRST EPSS
CISA Known Exploited Vulnerabilities
known-exploited-vulnerabilities-catalog
community.progress.com
labs.watchtowr.com
esentire.com
Learn more

Run an in-depth assessment with complete web risk management

CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.

Explore CyStack VulnScan

Explore other related solutions

LoadMaster

Progress Software

View product

ECS Connections Manager

Progress Software

View product

Object Scale Connection Manager

Progress Software

View product
View all security vulnerabilities