Loading vulnerability…
CVE-2026-8037 is a critical pre-authentication operating system command injection vulnerability affecting Progress LoadMaster and related Progress ADC products. The flaw resides in the product API and allows attacker-controlled input from multiple command endpoints to reach OS command execution logic without proper sanitization. Public technical analysis attributes the vulnerable path to processing associated with the /accessv2 API route and the access executable’s escape_quotes() function, where improper handling of quoted input, use of an uninitialized heap buffer, and failure to append a null terminator can cause an out-of-bounds read that contaminates a shell command later executed by the appliance. Successful exploitation enables arbitrary command execution on the appliance without authentication. Reported affected versions include LoadMaster GA v7.2.63.1 and earlier and LoadMaster LTSF v7.2.54.17 and earlier, with related impact also reported for ECS Connection Manager, Connection Manager for ObjectScale, and MOVEit WAF in some vendor and downstream reporting.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a working exploit set for CVE-2026-8037 targeting Progress LoadMaster / Progress ADC LoadMaster. The repo is small and purpose-built: README.md documents usage and exploitation theory, go.py is the main Python exploit utility, and poc.yaml is a Nuclei template for detection/verification. Because the repository includes a Nuclei template but also standalone exploit code, the overall repo is more than a detector; it contains active exploitation capability. The main exploit logic in go.py builds a malicious JSON body for POST requests to the unauthenticated /accessv2 endpoint. It sets apiuser to "''''" to trigger the described escape/null-termination flaw and sprays 61 g-fields (g0 through g60) containing shell metacharacters to increase reliability. The injected form is essentially: close context with a quote/semicolon, execute attacker-supplied shell command, then echo a random tag so the script can parse successful execution from the HTTP response body. Capabilities in go.py include: (1) single-target arbitrary command execution, (2) batch command execution across multiple targets using a thread pool, (3) fast and deep reconnaissance modes that run many post-exploitation commands, (4) basic OS detection to choose Linux vs Windows probe commands, and (5) reverse-shell staging. The probe lists show strong post-exploitation intent: hostname, kernel, users, interfaces, routes, ARP, listening ports, processes, mounts, passwd/shadow/sudoers, SSH keys, config/script discovery, and Docker/container checks. Reverse-shell mode is operational rather than just demonstrative: it expects the operator to host a shell script over HTTP and listen with netcat for a callback. The poc.yaml file is a Nuclei template that sends a single raw POST request to /accessv2 with the same malformed apiuser value and repeated g0-g60 injection fields. It verifies exploitation by matching a random echoed string in a 200 response. That file is primarily a detection/verification PoC, while go.py is the full exploitation tool. Overall, this is a real unauthenticated web/network RCE exploit repository, not a fake or README-only project. It targets a specific appliance API endpoint and provides both verification and operational exploitation workflows, including command execution and reverse shell delivery.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
165 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical unauthenticated command injection vulnerability in Progress LoadMaster load balancers that allows arbitrary command execution via unsanitized input in multiple command endpoints.
A critical unauthenticated command injection vulnerability in Progress LoadMaster and Progress ADC that can allow arbitrary command execution on vulnerable appliances.
A critical unauthenticated command injection vulnerability in Progress Kemp LoadMaster that allows arbitrary command execution via improperly handled API inputs across multiple command endpoints.
A critical unauthenticated command injection vulnerability in Progress Kemp LoadMaster that allows arbitrary command execution via unsanitized API inputs in multiple command endpoints.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.