DaystoPatch

Progress SoftwareExploited incident

Progress Kemp LoadMaster pre-authentication OS command injection (LoadMaster Critical Security Bulletin June 2026)

CVE-2026-8037Critical, CVSS 9.6In CISA's Known Exploited Vulnerabilities catalog since 7 Aug 2026

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Progress LoadMaster 7.2.63.2 release notesCuratedQuote verified

    LoadMaster Operating System (LMOS) version 7.2.63.2 is a security update of the General Availability (GA) branch made available on 4 June 2026.

    Vendor disclosure with fixes came first. watchTowr published a technical analysis and PoC on 29 Jun 2026; exploitation attempts were reported afterwards.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:8127a9aea5834f60…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    CVE.org record CVE-2026-8037ClaimedQuote verified4 Jun 2026, 13:13 UTC

    OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:e0fe82f088ba7954…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet4 Jun 2026, 15:39 UTC

    CVE-2026-8037 - OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Research: watchtowrClaimedQuote verified29 Jun 2026, 19:24 UTC

    Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)

    Earliest mention we hold (a vetted outlet).

    Source
    Research: watchtowr research
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0d89ad0e6238f050…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet30 Jun 2026, 09:43 UTC

    Progress LoadMaster Flaw Lets Attackers Run Root Commands Pre-Auth A critical flaw in Progress Kemp LoadMaster, known as CVE-2026-8037, allows attackers to run root commands without authentication - but a patch is now available to fix this gaping security hole. This vulnerability, scoring a severe

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-8037)ClaimedQuote verified7 Aug 2026

    Progress LoadMaster Command Injection Vulnerability

    Added to CISA's KEV catalog on 2026-08-07.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Progress LoadMaster 7.2.63.2 release notes, Security UpdatesCuratedQuote verified

    Fix for CVE-2026-8037

    Page shows 'Last Updated: June 4, 2026'. The primary bulletin (community.progress.com 'LoadMaster Critical Security Bulletin June 2026', the KEV reference) is a JavaScript-only Salesforce page that renders no text to curl or in Wayback captures, so its exact publication date could not be quoted; its earliest Wayback capture is 2026-06-05 13:39:05 UTC. The CVE record was published by Progress (CNA) with NVD 'published' 2026-06-04T14:16:45.177.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0179c3a341b3e395…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Progress LoadMaster 7.2.63.2 release notesCuratedQuote verified

    LoadMaster Operating System (LMOS) version 7.2.63.2 is a security update of the General Availability (GA) branch made available on 4 June 2026.

    The Security Updates page of these notes lists 'Fix for CVE-2026-8037'.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:8127a9aea5834f60…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Progress LoadMaster 7.2.54.18 (LTSF) release notesCuratedQuote verified

    LoadMaster Operating System (LMOS) version 7.2.54.18 is a security update of the Long Term Support Feature (LTSF) branch made available on 4 June 2026.

    Both supported LoadMaster branches (GA 7.2.63.2 and LTSF 7.2.54.18) shipped the same day; the 7.2.54.18 Security Updates page also lists 'Fix for CVE-2026-8037'. Fix dates for the other affected Progress ADC products (MOVEit WAF, ECS Connection Manager, ObjectScale Connection Manager) were not separately verified because the bulletin is not readable without JavaScript.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:56638fb9fac03800…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Progress Kemp LoadMaster (GA and LTSF branches)
  • Progress MOVEit WAF
How we built this timeline

Coordinated disclosure, exploited after the fix. watchTowr Labs analysis and PoC: 'Published 29 Jun 2026' (https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/). The Hacker News (Aug 08, 2026) reports 792 exploitation attempts over the preceding 41 days, i.e. starting late June 2026, after the 4 June fixes.

CVSS 9.6 is Progress's CNA score (AV:A); NVD scores it 9.8 (AV:N).

Workaround moment omitted: the bulletin text could not be retrieved. Reviewer: if a browser is available, confirm the bulletin's own publication date on community.progress.com.

Related

No related incidents.

Progress Software report card