Loading story…
Progress Software released security updates for multiple products, including Progress LoadMaster, Sitefinity CMS, and Sitefinity Insight, warning that the vulnerabilities could expose sensitive information, let attackers modify other users' account properties, or enable arbitrary code execution. The most severe issues disclosed were CVE-2026-7312, an insufficiently protected credentials flaw in Sitefinity web services rated CVSS 10.0, and CVE-2026-8037, a CVSS 9.6 command-injection vulnerability in Progress LoadMaster.
Technical analysis published after the advisory showed that CVE-2026-8037 is a pre-authentication remote code execution flaw in Kemp LoadMaster when its API is enabled, affecting GA v7.2.63.1 and earlier and LTSF v7.2.54.17 and earlier. Researchers said the bug stems from an uninitialized heap buffer and missing null terminator in the escape_quotes() function used by the /accessv2 endpoint, allowing attacker-controlled input to be incorporated into a shell command executed via system(). Progress patched the issue in v7.2.63.2 by replacing malloc() with calloc() and adding explicit string termination, and defenders were urged to apply updates as soon as testing is complete.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
watchTowr Labs published a technical analysis detailing how an uninitialized heap buffer and missing null terminator in LoadMaster's access executable could be exploited for pre-authentication remote code execution. The analysis also noted that Progress patched the flaw in version 7.2.63.2.
Progress Software Corporation released security updates to remediate multiple vulnerabilities affecting Progress Sitefinity CMS, Sitefinity Insight, and Progress LoadMaster. The notice specifically highlighted CVE-2026-7312 and CVE-2026-8037 and urged enterprises to deploy patches after testing.
Progress described CVE-2026-8037 as a command injection remote code execution vulnerability in a security advisory. The advisory date is explicitly referenced as June 4, 2026.
A June 2 ZeroPath blog described CVE-2026-7198 as a critical unauthenticated access control bypass in Progress Sitefinity OData Web Services that could let remote attackers access restricted content. The post said Progress disclosed the flaw, identified it as affecting Sitefinity CMS 15.4.8623 through 15.4.8629, and fixed it in version 15.4.8630, with no confirmed active exploitation as of publication.
A June 2 ZeroPath blog described CVE-2026-7312 as a CVSS 10.0 plaintext credential exposure in Progress Sitefinity's OData Web Services that could let unauthenticated attackers retrieve Sitefinity Insight credentials under specific configurations. The post said Progress had disclosed the issue alongside other Sitefinity CVEs in May 2026 and that patched versions were available for affected branches, with no confirmed active exploitation as of June 2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceegfincirt.org.eg
Open sourcezeropath.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Progress released security updates for **Sitefinity CMS**, **Sitefinity Insight**, and **Kemp LoadMaster**, with the most urgent attention on multiple severe Sitefinity web-service vulnerabilities affecting versions from **8.0 through 15.4**. The Canadian Centre for Cyber Security flagged the vendor advisories and urged administrators to review Progress bulletins and apply patches. Among the Sitefinity issues, **`CVE-2026-7312`** carries a **CVSS 10.0** rating and can let an unauthenticated attacker obtain plaintext credentials used for **Sitefinity Insight** connections when that integration is enabled in a non-default configuration, while **`CVE-2026-7198`** is rated **CVSS 9.8** and allows unauthenticated access to restricted content in affected **15.4** deployments. Additional Sitefinity flaws include **`CVE-2026-7201`**, an authorization bypass that can let an authenticated low-privilege user modify other users' account properties, and **`CVE-2026-7313`**, which exposes Insight credentials to authenticated back-end users under specific configurations. Progress published patched releases including **15.4.8630**, **15.3.8531**, **15.2.8441**, **15.1.8335**, **15.0.8234**, **14.4.8152**, and **13.3.7652**, and warned that delaying remediation leaves OData and related web services open to unauthorized exploitation. The broader advisory set also includes two vulnerabilities affecting **Progress Kemp LoadMaster**.
Jun 29, 2026
Progress Software disclosed and patched serious vulnerabilities in **Kemp LoadMaster** that could let attackers compromise load balancers deployed at the core of enterprise networks. The most prominent issue, tracked as **`CVE-2026-8037`**, was described in public advisories as affecting API methods including `dodelapikey` and `dolistapikeys`, where improper handling of memory could allow remote code execution after authentication, in some cases with **root** or administrator-level impact. Separate reporting also characterized `CVE-2026-8037` as a critical API command-injection issue that could permit arbitrary command execution and full administrative control of the appliance. Progress released updates to address the flaws, including patched firmware versions **`v7.2.63.2`** and **`v7.2.54.18`**, and said the fixes also apply to **ECS Connection Manager** and **Connection Manager for ObjectScale**. A second vulnerability, **`CVE-2026-33691`**, affects the **OWASP CRS** handling of multipart requests by failing to normalize whitespace in filenames, creating a path to bypass firewall extension checks. Security researchers credited in the disclosures include **Syed Ibrahim Ahmed** and **Jacky Yang** of TrendAI Research, and defenders were urged to patch quickly because compromise of internet-facing load balancers could provide a foothold for deeper intrusion into enterprise environments.
Jul 2, 2026
Progress disclosed two high-severity OS command injection vulnerabilities in its ADC product line, including **LoadMaster**, **ECS Connection Manager**, **Object Scale Connection Manager**, and **MOVEit WAF**. The issues, tracked as `CVE-2026-3517` and `CVE-2026-3519`, affect the API and can lead to remote code execution when authenticated administrators submit unsanitized input to specific commands. Both flaws are classified as `CWE-77` and carry a `CVSS v3.1` vector of `AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`, indicating high impact across confidentiality, integrity, and availability. `CVE-2026-3517` allows an attacker with **Geo Administration** permissions to exploit the `addcountry` command, while `CVE-2026-3519` requires **VS Administration** permissions to abuse the `aclcontrol` command. In both cases, Progress said arbitrary commands could be executed through the vulnerable API, and the vendor published an advisory covering these and related CVEs. Organizations using affected appliances should prioritize reviewing administrative access and applying vendor guidance to reduce exposure to authenticated abuse paths.
Jun 29, 2026