Loading vulnerability…
CVE-2026-8037 is a critical unauthenticated OS command injection vulnerability affecting the API of Progress LoadMaster and related Progress ADC products. The flaw is caused by improper neutralization of attacker-controlled input across multiple command endpoints before that input is incorporated into operating system command execution. Public technical analysis attributes the vulnerable code path to the access component, specifically the escape_quotes() function used while handling requests to the accessv2 API endpoint. In affected versions, the function allocates an uninitialized heap buffer and fails to append a null terminator after escaping quote characters. As a result, subsequent formatting logic can read beyond the intended buffer boundary and incorporate attacker-controlled data into a shell command that is later executed. Because the vulnerable API surface is reachable without authentication, a remote attacker can exploit the issue to execute arbitrary commands on the appliance. Affected products include Progress LoadMaster, ECS Connection Manager, Connection Manager for ObjectScale, and related appliance variants running vulnerable releases prior to the fixed versions issued in June 2026.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a working exploit set for CVE-2026-8037 targeting Progress LoadMaster / Progress ADC LoadMaster. The repo is small and purpose-built: README.md documents usage and exploitation theory, go.py is the main Python exploit utility, and poc.yaml is a Nuclei template for detection/verification. Because the repository includes a Nuclei template but also standalone exploit code, the overall repo is more than a detector; it contains active exploitation capability. The main exploit logic in go.py builds a malicious JSON body for POST requests to the unauthenticated /accessv2 endpoint. It sets apiuser to "''''" to trigger the described escape/null-termination flaw and sprays 61 g-fields (g0 through g60) containing shell metacharacters to increase reliability. The injected form is essentially: close context with a quote/semicolon, execute attacker-supplied shell command, then echo a random tag so the script can parse successful execution from the HTTP response body. Capabilities in go.py include: (1) single-target arbitrary command execution, (2) batch command execution across multiple targets using a thread pool, (3) fast and deep reconnaissance modes that run many post-exploitation commands, (4) basic OS detection to choose Linux vs Windows probe commands, and (5) reverse-shell staging. The probe lists show strong post-exploitation intent: hostname, kernel, users, interfaces, routes, ARP, listening ports, processes, mounts, passwd/shadow/sudoers, SSH keys, config/script discovery, and Docker/container checks. Reverse-shell mode is operational rather than just demonstrative: it expects the operator to host a shell script over HTTP and listen with netcat for a callback. The poc.yaml file is a Nuclei template that sends a single raw POST request to /accessv2 with the same malformed apiuser value and repeated g0-g60 injection fields. It verifies exploitation by matching a random echoed string in a 200 response. That file is primarily a detection/verification PoC, while go.py is the full exploitation tool. Overall, this is a real unauthenticated web/network RCE exploit repository, not a fake or README-only project. It targets a specific appliance API endpoint and provides both verification and operational exploitation workflows, including command execution and reverse shell delivery.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
174 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An OS command injection remote code execution vulnerability in the API of Progress LoadMaster / ADC products that allows unauthenticated attackers to execute arbitrary commands on the appliance via unsanitized input in multiple command endpoints.
A critical unauthenticated command injection vulnerability in Progress LoadMaster load balancers that allows arbitrary command execution via unsanitized input in multiple command endpoints.
A critical unauthenticated command injection vulnerability in Progress LoadMaster and Progress ADC that can allow arbitrary command execution on vulnerable appliances.
A critical unauthenticated command injection vulnerability in Progress Kemp LoadMaster that allows arbitrary command execution via improperly handled API inputs across multiple command endpoints.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.