Loading vulnerability…
CVE-2026-8037 is a critical unauthenticated OS command injection vulnerability in the API of Progress ADC products, including Progress Kemp LoadMaster. Multiple command-processing interfaces fail to properly neutralize attacker-controlled input before it reaches operating-system command execution. Technical analysis associates the flaw with unsafe handling in the escape_quotes() function: an allocated output buffer may lack a null terminator, causing an out-of-bounds read that can incorporate attacker-controlled command-injection data before execution through a system command invocation. Affected releases include LoadMaster GA 7.2.63.1 and earlier, LoadMaster LTSF 7.2.54.17 and earlier, ECS Connection Manager 7.2.63.1 and earlier, and Connection Manager for ObjectScale 7.2.63.1 and earlier. The vulnerability has been actively exploited.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a working exploit set for CVE-2026-8037 targeting Progress LoadMaster / Progress ADC LoadMaster. The repo is small and purpose-built: README.md documents usage and exploitation theory, go.py is the main Python exploit utility, and poc.yaml is a Nuclei template for detection/verification. Because the repository includes a Nuclei template but also standalone exploit code, the overall repo is more than a detector; it contains active exploitation capability. The main exploit logic in go.py builds a malicious JSON body for POST requests to the unauthenticated /accessv2 endpoint. It sets apiuser to "''''" to trigger the described escape/null-termination flaw and sprays 61 g-fields (g0 through g60) containing shell metacharacters to increase reliability. The injected form is essentially: close context with a quote/semicolon, execute attacker-supplied shell command, then echo a random tag so the script can parse successful execution from the HTTP response body. Capabilities in go.py include: (1) single-target arbitrary command execution, (2) batch command execution across multiple targets using a thread pool, (3) fast and deep reconnaissance modes that run many post-exploitation commands, (4) basic OS detection to choose Linux vs Windows probe commands, and (5) reverse-shell staging. The probe lists show strong post-exploitation intent: hostname, kernel, users, interfaces, routes, ARP, listening ports, processes, mounts, passwd/shadow/sudoers, SSH keys, config/script discovery, and Docker/container checks. Reverse-shell mode is operational rather than just demonstrative: it expects the operator to host a shell script over HTTP and listen with netcat for a callback. The poc.yaml file is a Nuclei template that sends a single raw POST request to /accessv2 with the same malformed apiuser value and repeated g0-g60 injection fields. It verifies exploitation by matching a random echoed string in a 200 response. That file is primarily a detection/verification PoC, while go.py is the full exploitation tool. Overall, this is a real unauthenticated web/network RCE exploit repository, not a fake or README-only project. It targets a specific appliance API endpoint and provides both verification and operational exploitation workflows, including command execution and reverse shell delivery.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
190 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical unauthenticated command injection vulnerability affecting multiple API endpoints in Progress LoadMaster, enabling mass exploitation against internet-exposed instances.
An OS command injection remote code execution vulnerability in the API of Progress LoadMaster / ADC products that allows unauthenticated attackers to execute arbitrary commands on the appliance via unsanitized input in multiple command endpoints.
A critical unauthenticated command injection vulnerability in Progress LoadMaster load balancers that allows arbitrary command execution via unsanitized input in multiple command endpoints.
A critical unauthenticated command injection vulnerability in Progress LoadMaster and Progress ADC that can allow arbitrary command execution on vulnerable appliances.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.