CVE-2026-8037
KEV
🔴 Łataj teraz
Wstrzyknięcie poleceń w API Progress ADC umożliwia zdalne wykonanie dowolnych komend.
CVSS
9.6
EPSS
99.3%
Exploit
weaponized
Vendor
progress
Opis źródłowy (NVD)
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
exploit rce
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 9.6 |
| CISA KEV (aktywnie wykorzystywane) | Tak |
| FIRST EPSS (prawdopodobieństwo exploita) | 99.3% |
| Opublikowano (NVD) | 2026-06-04 14:16:45 UTC |
| Ostatnia modyfikacja (NVD) | 2026-08-10 20:19:44 UTC |
Referencje
- https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691 (security@progress.com) [Patch, Vendor Advisory]
- https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/ (134c704f-9b21-4f2e-91b3-4a467353bcc0) [Exploit, Patch, Third Party Advisory]
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037 (134c704f-9b21-4f2e-91b3-4a467353bcc0) [US Government Resource]
- https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037 (134c704f-9b21-4f2e-91b3-4a467353bcc0) [Third Party Advisory]