CVE-2026-8037: OS Command Injection Remote Code Execution Vulnerability in

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

• CISA KEV-listed (remediation due 2026-08-10)
• EPSS 99.3% (99.9% percentile)
• CVSS 9.6 critical

Related briefings

• F5 BIG-IP DNS flaw has no patch, only workarounds 2026-08-11
• Attackers exploit a critical Progress LoadMaster flaw 2026-08-07
• Critical Oracle, Kemp, and Linux flaws come under active attack 2026-07-06
• Critical Kemp LoadMaster bug lets hackers run code without a login 2026-06-29

Browse the CVE database

Read the full analysis on IntelFusions