Progress LoadMaster CVE-2026-8037

Exploitation requires network access to the appliance's management/command API endpoints (the 'multiple command endpoints' named in the description) - no authentication, no user interaction, and low complexity per the CVSS vector (AV:N/AC:L/PR:N/UI:N), so default configurations of internet- or network-exposed Progress ADC management APIs are directly exploitable. The main limiting factor is reachability: the attacker must be able to route to the management API, so appliances whose admin/API interface is confined to an isolated management network are not exposed to arbitrary remote attackers. Exploitation is also bounded to the affected firmware ranges (7.2.60.0-<7.2.63.2, and LoadMaster 7.2.45.12-<7.2.54.18); patched builds 7.2.63.2 and 7.2.54.18 remove the condition. SSVC 'Automatable: no' suggests the attack is not trivially wormable despite the public PoC.

Signals are strong on impact but mixed on imminence. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes the worst case: network-reachable, low-complexity, no authentication, no user interaction, with total compromise of the appliance - consistent with SSVC's 'Technical Impact: total.' Countering this, SSVC records 'Exploitation: none' and 'Automatable: no,' and EPSS is only 0.30% (54th percentile), indicating no evidence yet of widespread or automated exploitation. Publicly available exploit code (GitHub PoC) raises the practical risk above the EPSS figure, since a working PoC lowers the barrier to opportunistic attacks against internet-facing ADC appliances. Note a conflict to resolve: one reference is hosted under CIRCL's 'known-exploited-vulnerabilities-catalog' path, which could imply KEV-style listing, yet the input's SSVC exploitation status is 'none' and no explicit KEV=YES flag was provided - do not treat this as confirmed active exploitation without corroboration. Net: given a pre-auth RCE on a perimeter appliance with a public PoC, this warrants priority patching despite the low EPSS.

An attacker who can reach the appliance's management API over the network sends a crafted request to one of the vulnerable command endpoints, embedding shell metacharacters in an unsanitized parameter; the appliance passes the input to a shell and executes the attacker's commands as the API's privileged context, no credentials required. With total technical impact this yields full compromise of the ADC/load balancer, enabling interception of proxied traffic, pivoting, or persistence. A public proof-of-concept is available on GitHub (HORKimhab/CVE-2026-8037), lowering the effort to reproduce.