Loading vulnerability…
CVE-2026-8037 is a critical pre-authentication operating system command injection vulnerability in the API of Progress ADC products, including Progress Kemp LoadMaster. The flaw allows attacker-controlled input from API requests to reach OS command execution logic without proper sanitization. Public technical analysis ties exploitation to the access executable, specifically the handling of the apiuser parameter in the /accessv2 code path and the escape_quotes() function. In vulnerable versions, the function allocates an uninitialized heap buffer and fails to append a null terminator after escaping single quotes. As a result, subsequent formatting logic can read beyond the intended buffer into adjacent heap memory, allowing attacker-influenced data to be incorporated into a shell command later executed by the appliance. Successful exploitation does not require authentication and can result in arbitrary command execution on the affected device, reportedly in the context of root. Affected versions include LoadMaster GA 7.2.63.1 and earlier and LoadMaster LTSF 7.2.54.17 and earlier; related Progress ADC product lines were also reported affected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a working exploit set for CVE-2026-8037 targeting Progress LoadMaster / Progress ADC LoadMaster. The repo is small and purpose-built: README.md documents usage and exploitation theory, go.py is the main Python exploit utility, and poc.yaml is a Nuclei template for detection/verification. Because the repository includes a Nuclei template but also standalone exploit code, the overall repo is more than a detector; it contains active exploitation capability. The main exploit logic in go.py builds a malicious JSON body for POST requests to the unauthenticated /accessv2 endpoint. It sets apiuser to "''''" to trigger the described escape/null-termination flaw and sprays 61 g-fields (g0 through g60) containing shell metacharacters to increase reliability. The injected form is essentially: close context with a quote/semicolon, execute attacker-supplied shell command, then echo a random tag so the script can parse successful execution from the HTTP response body. Capabilities in go.py include: (1) single-target arbitrary command execution, (2) batch command execution across multiple targets using a thread pool, (3) fast and deep reconnaissance modes that run many post-exploitation commands, (4) basic OS detection to choose Linux vs Windows probe commands, and (5) reverse-shell staging. The probe lists show strong post-exploitation intent: hostname, kernel, users, interfaces, routes, ARP, listening ports, processes, mounts, passwd/shadow/sudoers, SSH keys, config/script discovery, and Docker/container checks. Reverse-shell mode is operational rather than just demonstrative: it expects the operator to host a shell script over HTTP and listen with netcat for a callback. The poc.yaml file is a Nuclei template that sends a single raw POST request to /accessv2 with the same malformed apiuser value and repeated g0-g60 injection fields. It verifies exploitation by matching a random echoed string in a 200 response. That file is primarily a detection/verification PoC, while go.py is the full exploitation tool. Overall, this is a real unauthenticated web/network RCE exploit repository, not a fake or README-only project. It targets a specific appliance API endpoint and provides both verification and operational exploitation workflows, including command execution and reverse shell delivery.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
90 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An OS command injection vulnerability in the Progress LoadMaster API, described as requiring adjacent-network access and carrying a CVSS score of 9.6.
A critical unauthenticated OS command injection vulnerability in Progress Kemp LoadMaster that can lead to pre-auth remote code execution via the LoadMaster API.
A critical unauthenticated operating system command injection vulnerability in Progress Kemp LoadMaster appliances that can allow arbitrary code/command execution via specially crafted requests to the /accessv2 endpoint due to improper input handling in the escape_quotes() function.
A critical OS command injection vulnerability in the API of Progress Kemp LoadMaster that can allow an unauthenticated attacker to execute arbitrary commands on affected appliances.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.