CVE-2026-8037

Critical

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute…

ProgressSoftware·CWE-77·Published 2026-06-04

CVSS

9.8

EPSS

0.85

KEV

Exploits

Vendor statements (1)

community.progress.com

cve.orgen

244 chars

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

NVDes

297 chars

Vulnerabilidad de ejecución remota de código por inyección de comandos del sistema operativo en la API en Productos Progress ADC permite a un atacante no autenticado ejecutar comandos arbitrarios en el dispositivo LoadMaster explotando la entrada no saneada en múltiples puntos finales de comando.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	NVD	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1	Primary	cve.org	9.6	—	—	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
3.1	Secondary	NVD	9.6	2.8	6.0	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
3.1	Secondary	ENISA EUVD	9.6	—	—	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H