01 Record

CVE-2026-8037

OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

CriticalKEVPUBLISHEDCNA: ProgressSoftware

Base score9.6 CVSS v3.xCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

02 Description

OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

Published

2026-06-04 13:13Z2 MO AGO

Last updated

2026-08-08 03:55Z6 DAYS AGO

Reserved

2026-05-06

Assigning CNA

ProgressSoftware

Record state

PUBLISHED

Severity

Critical (CVSS 9.6)

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')Class

SSVC decision

ExploitationpocAutomatablenoTechnical Impacttotal

KEV catalog

Added 2026-08-07 · remediation due 2026-08-10

Data version

5.2

Document digest

c4493db257b08a5b24a63b1995daba49acc13ed5d76c30f5fdbfdfc2a0ef79ed

VendorProductVersionsPlatforms

Progress SoftwareLoadMasterV7.2.60.0 to < V7.2.63.2, V7.2.45.12 to < V7.2.54.18—

Progress SoftwareECS Connections ManagerV7.2.60.0 to < V7.2.63.2—

Progress SoftwareObject Scale Connection ManagerV7.2.60.0 to < V7.2.63.2—

Progress SoftwareMOVEit WAFV7.2.60.0 to < V7.2.63.2—