CVE-2026-8037

What it actually does

CVE-2026-8037 is an unauthenticated OS command injection vulnerability in the API of Progress ADC / LoadMaster appliances. Unsanitized input to multiple command endpoints can be interpreted by the appliance operating system, allowing an attacker with network reachability to the vulnerable API to execute arbitrary shell commands. Successful exploitation can provide full compromise of the appliance, including command execution, configuration theft, credential or certificate exposure, persistence, traffic interception, and disruption of load-balancing services. The CVSS score is 9.6 and exploitation is reported as active in the wild, with a high EPSS score of 0.84793, indicating a high likelihood of exploitation activity.

Why it matters to the business

A compromised ADC or LoadMaster appliance can directly affect application availability, confidentiality, and integrity because it often sits in front of business-critical services and handles sensitive traffic. Attackers may use the appliance to steal configuration data, certificates, session material, or credentials; alter routing behavior; intercept or redirect traffic; deploy persistence; or cause outages. Because this vulnerability is in CISA KEV with a remediation due date of 2026-08-10 and active exploitation has been observed, organizations should treat exposed appliances as urgent remediation targets even though ransomware use has not been reported for this CVE.

How an attack unfolds

An attacker first identifies a reachable Progress ADC / LoadMaster API interface. Because the flaw requires no authentication, the attacker sends crafted requests to vulnerable command-related API endpoints containing shell metacharacters or command payloads in parameters that are not properly sanitized. The application passes the attacker-controlled input to the underlying operating system, causing the appliance to execute arbitrary commands. The attacker typically validates execution with low-impact commands such as identity, hostname, or network callbacks, then escalates to downloading tools, writing files under temporary directories, creating persistence, dumping appliance configuration, collecting keys or certificates, modifying network behavior, or using the appliance as a foothold to reach protected internal services. Since exploitation is active in the wild, investigation should assume that internet- or broadly network-reachable management/API interfaces may already have been probed or targeted.

How to fix it

Upgrade all affected Progress ADC / LoadMaster appliances to the vendor-provided fixed release as soon as it is available for the deployed product line and version. No exact fixed versions were provided in the input, so administrators should consult the official Progress advisory and apply the current security update or hotfix for CVE-2026-8037. If immediate patching is not possible, restrict access to API and management interfaces to dedicated administrative networks or VPNs, block internet exposure, enforce firewall allowlists, disable unnecessary API access, and monitor for command injection attempts. Treat exposed or suspicious appliances as potentially compromised: preserve logs, collect forensic images where feasible, rotate administrative credentials, rotate certificates or keys stored on the appliance if compromise is suspected, and validate configuration integrity after remediation.

How to confirm the fix worked

Confirm the appliance is running a vendor-fixed version or hotfix level documented by Progress for CVE-2026-8037. Verify that API and management interfaces are not exposed to untrusted networks and are reachable only from approved administrative sources. Review firewall, ACL, and reverse-proxy rules to confirm access restrictions are enforced. Where safe and authorized, perform a non-destructive validation using vendor guidance or a security scanner that checks for the vulnerable API behavior without executing harmful commands. Validate that crafted inputs containing shell metacharacters are rejected, sanitized, or logged without command execution. After patching, review appliance configuration, user accounts, scheduled tasks, startup scripts, certificates, and recent file modifications to ensure no persistence or unauthorized changes remain.

Typical attack path

1. Discover Progress ADC / LoadMaster API or management interfaces reachable from the attacker’s network position.
2. Send unauthenticated requests to vulnerable API command endpoints with injected shell syntax in request parameters.
3. Confirm command execution using benign commands or outbound callback traffic.
4. Execute reconnaissance commands to identify appliance version, privileges, interfaces, routing, and stored configuration.
5. Download or stage additional tooling using built-in utilities such as curl, wget, busybox, or shell redirection.
6. Exfiltrate configuration, credentials, certificates, logs, or network information from the appliance.
7. Establish persistence or recurring access where possible, such as scheduled jobs, modified startup scripts, added users, or dropped binaries.
8. Use the compromised appliance to intercept, redirect, disrupt, or pivot into applications and networks behind the ADC.

How to detect it

Review appliance API, management, web access, system, audit, and network logs for unauthenticated requests containing shell metacharacters, command substitution, URL-encoded separators, or attempts to run operating system utilities. Focus on the period since publication on 2026-06-04, with heightened scrutiny for internet-facing or broadly reachable appliances. Look for requests followed by outbound connections, new files in temporary or writable directories, abnormal child process execution, unexpected configuration exports, failed or unusual API calls, and changes to users, certificates, virtual services, routing, or persistence settings. Network telemetry should be checked for unusual outbound HTTP/HTTPS downloads, DNS lookups to unfamiliar domains, connections to VPS/cloud hosting providers, reverse shells, or beaconing from the appliance. Host-level or appliance forensic review should include process history if available, shell history, modified startup scripts, cron or scheduled tasks, new binaries, changed permissions, and recently modified files. If threat intelligence names specific campaigns later, correlate their infrastructure, user agents, tooling, and payload hashes against appliance and perimeter logs.

• ;/bin/sh
• %3B/bin/sh
• |/bin/sh
• %7C/bin/sh
• `id`
• $(id)
• ;id;
• %3Bid%3B
• &&id
• %26%26id
• ;whoami
• %3Bwhoami
• ;uname -a
• %3Buname%20-a
• ;cat /etc/passwd
• %3Bcat%20/etc/passwd
• wget http://
• curl http://
• curl -O
• busybox wget
• chmod +x /tmp/
• /tmp/.
• nc -e /bin/sh
• netcat -e /bin/sh
• bash -i
• /dev/tcp/
• python -c 'import pty'
• python3 -c 'import pty'
• crontab -e
• /etc/crontab
• /etc/cron.d/
• /etc/init.d/
• /etc/rc.local

What your security team should do

• Immediately inventory all Progress ADC / LoadMaster appliances and determine which expose API or management interfaces to untrusted, partner, wireless, or broadly routed networks.
• Prioritize emergency patching because the vulnerability is KEV-listed, actively exploited in the wild, and has a high EPSS probability; meet or beat the 2026-08-10 KEV remediation deadline.
• If patching cannot be completed immediately, isolate management/API access using firewall allowlists, VPN-only access, and administrative network segmentation.
• Search historical logs for command injection patterns, unauthenticated API access anomalies, suspicious outbound connections, and shell utility execution from the appliance.
• Assume exposed vulnerable appliances may be compromised; perform forensic triage before rebooting or rebuilding where evidence preservation is required.
• Rotate appliance administrator credentials and any certificates, private keys, API keys, or service credentials stored on the appliance if exploitation is suspected.
• Review appliance configuration for unauthorized routing, virtual service, persistence, health-check, authentication, or certificate changes.
• Add detection coverage for shell metacharacters in API requests and unexpected process execution such as shell, curl, wget, busybox, netcat, or chmod from appliance service contexts.
• Monitor outbound traffic from ADC appliances for unusual DNS, HTTP, HTTPS, SSH, or raw TCP connections to external infrastructure.
• After remediation, run an authenticated configuration and version audit to confirm all appliances are fixed and exposure controls remain in place.