Progress ADC exploited for unauthenticated RCE (CVE-2026-8037) [PoC]

Actively exploited in the wild - CVE-2026-8037 is a critical OS command injection flaw in Progress ADC LoadMaster that grants unauthenticated remote code execution on the appliance. Patches are available; update immediately and restrict adjacent network access.

Overview

CVE-2026-8037 is a pre-authentication OS command injection vulnerability affecting Progress Application Delivery Controller (ADC) products, including the LoadMaster appliance. The flaw resides in multiple command endpoints of the API, where unsanitized user input is passed directly to operating system commands. An attacker positioned on the adjacent network can exploit this without any credentials or user interaction, achieving full remote code execution with elevated privileges on the underlying appliance.

The vulnerability carries a CVSS score of 9.8 (Critical) with a low attack complexity, reflecting how easily it can be triggered. Critically, CISA has added CVE-2026-8037 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in real-world environments. The EPSS model predicts an 84.8% probability of exploitation within 30 days, making this a top-priority threat for any organization running affected LoadMaster versions.

Impact

Successful exploitation grants the attacker arbitrary command execution as the LoadMaster service user, which typically runs with root or elevated privileges. This means full compromise of the ADC appliance, including:

• Data exposure: Access to all traffic that passes through the LoadMaster, including TLS-terminated session data, credentials, and application payloads.
• Lateral movement: The compromised appliance becomes a pivot point into the internal network, bypassing perimeter security controls.
• Persistent backdoor: Attackers can install persistent malware, modify load-balancing rules, or redirect traffic to malicious endpoints.
• Service disruption: The appliance can be taken offline, taking down every application and service behind it.

Remediation and Mitigation

Progress has released security patches addressing CVE-2026-8037. Organizations should take the following steps immediately:

1. Apply vendor patches: Upgrade affected LoadMaster and ADC installations to the patched versions specified in the Progress security advisory. This is the only complete fix.
2. Restrict network access: Where patching is not immediately possible, restrict access to the management API to trusted administrative networks only. Do not expose the API to untrusted segments.
3. Audit for compromise: Assume breach if the appliance was exposed to adjacent networks. Review logs for anomalous API calls, unexpected command execution, or new administrative accounts.
4. Monitor CISA KEV: Continue tracking CISA’s KEV catalog for updated indicators of compromise and detection guidance.

Security Insight

CVE-2026-8037 follows a disturbing pattern of enterprise network appliances becoming primary intrusion targets. Unlike server-side software that can be patched in minutes, ADCs and similar edge devices often run customized, minimally updated firmware where security fixes lag behind discovery. The combination of unauthenticated access and OS-level command execution in a device that sees all network traffic makes this class of vulnerability disproportionately damaging. Organizations should treat their ADC fleet as a crown-jewel asset, apply patches aggressively, and segment management interfaces away from general network traffic as a baseline security posture.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs