CVE-2026-8037

This vulnerability is like leaving a “remote control” command channel in software. An attacker who can reach the device can send specially crafted input that tricks the system into running commands on the server—no login required.

For a business, that can mean attackers gain control of the appliance, disrupt services, and potentially move on to steal data or install further malware.

This matters if your organization runs Progress LoadMaster, ECS Connections Manager, Object Scale Connection Manager, or MOVEit WAF on a network that an attacker might reach.

It’s a risk because the issue can be triggered without authentication, and it’s described as reachable via an adjacent-network path; in plain terms, exposure to untrusted networks (or weak firewalling) increases risk. If the relevant services are not reachable from outside/trusted boundaries, the risk is lower.

This is urgent because the flaw allows an attacker to run arbitrary commands without authentication, which is the kind of weakness ransomware and intruders often look for.

Even though there’s no confirmed public report of exploitation in the articles reviewed, the risk remains high due to the remote, unauthenticated nature of the problem. Treat this as a priority patch now to prevent a potential compromise.

1. Confirm what you run

   • Inventory the installed components: Progress LoadMaster, ECS Connections Manager, Object Scale Connection Manager, and MOVEit WAF.
   • Record the exact version of each.

2. Determine if you’re vulnerable

   • If any component is at a version earlier than the listed fixed releases, you should treat it as vulnerable.
   • Fixed versions provided:
     • LoadMaster: fixed in V7.2.63.2 and V7.2.54.18
     • ECS Connections Manager: fixed in V7.2.63.2
     • Object Scale Connection Manager: fixed in V7.2.63.2
     • MOVEit WAF: fixed in V7.2.63.2

3. Upgrade path

   • Plan an upgrade for each affected component to the corresponding fixed version(s).
   • Prefer V7.2.63.2 where applicable to align across components.
   • If you are on LoadMaster specifically and cannot move directly to V7.2.63.2, V7.2.54.18 is also listed as a fixed version for LoadMaster.

4. Temporary workaround if you can’t patch yet

   • Because exploitation does not require authentication, focus on reachability control:
     • Restrict inbound access so the affected endpoints are not reachable from untrusted networks.
     • Allow only trusted/internal sources as needed.

5. Post-upgrade validation

   • Verify services are functioning normally.
   • Review logs for suspicious request patterns targeting command endpoints (e.g., unusual probing from network segments that shouldn’t access the device).

6. Ongoing monitoring

   • Monitor for repeated probing attempts and unexpected outbound connections from the appliance after changes.
   • Keep an eye on vendor advisories for any follow-on updates or additional mitigations.

Severity is effectively critical: the CVE is described as an OS command injection leading to remote code execution, with unauthenticated attackers able to execute arbitrary commands.

Weakness type is CWE-77 (command injection), and the described trigger is unsanitized input in multiple command endpoints within the API of the affected Progress ADC products.

Findings summary: no CISA KEV listing, no clear dated press claim of exploitation, and no public exploit code observed, which suggests exploit maturity is not clearly established publicly. However, the attack does not require authentication and has a remote path described as adjacent_network, so exposure is the main risk factor.

Patch availability is confirmed: V7.2.63.2 is listed as the fixed release for LoadMaster, ECS Connections Manager, Object Scale Connection Manager, and MOVEit WAF; additionally, LoadMaster is listed as fixed in V7.2.54.18. Verdict: AMBER (address promptly).