CVE-2026-8037: OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

Synopsis

OS command injection vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an unauthenticated attacker on an adjacent network to execute arbitrary operating system commands on the appliance. The flaw exists because multiple API command endpoints pass user-supplied input to the underlying OS without sanitization, and no credentials are required to trigger it. Successful exploitation gives the attacker full remote code execution on the affected appliance, with high impact to confidentiality, integrity, and availability. Patched-image rebuilds at V7.2.54.18 and V7.2.63.2 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attack requires adjacency to the target network, meaning the attacker must be on the same LAN, VLAN, or connected VPN segment as the affected appliance.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerable API endpoints accept and process unauthenticated requests.

• Victim interactionNot required

  The attacker sends a crafted request directly to the appliance; no user action or interaction is involved.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; no race conditions, memory layout dependencies, or special environmental factors are required.

Blast Radius

• Attacker executes arbitrary operating system commands as a privileged process on the affected appliance, effectively owning the host.
• All data handled by the appliance, including proxied traffic, session state, and stored credentials, is readable by the attacker.
• The attacker can modify appliance configuration, routing rules, and persisted data, enabling traffic interception or redirection.
• The attacker can crash or render the appliance unavailable, disrupting load balancing, WAF enforcement, and connection management for dependent workloads.