Progress LoadMaster command injection actively exploited
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CVE-2026-8037 in Progress LoadMaster allows remote command injection and is actively exploited in the wild.
CISA has added CVE-2026-8037, a command injection vulnerability in Progress LoadMaster, to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Command injection is a frequently exploited attack vector used by malicious actors to gain control of affected systems. The vulnerability grants total control of the asset post-exploitation, making it a high-priority target for remediation.
Federal Civilian Executive Branch agencies are required under Binding Operational Directive (BOD) 26-04 to prioritize rapid remediation of this and other KEV Catalog vulnerabilities on publicly exposed assets. CISA encourages all organizations to adopt risk-based vulnerability management practices and treat this vulnerability as a priority for patching. Organizations should also verify whether attackers compromised their systems before patches were applied.
Mentioned in this report
Detection guidance
Shell Command Injection Metacharacters with Download or Shell Commands in Web Request Query
Detects web requests whose query string chains a download tool or shell binary after a command separator or substitution. This is typical of command injection against appliance web/API interfaces such as Progress LoadMaster. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Command Injection Metacharacters with Download or Shell Commands in Web
Request Query
description: Detects web requests whose query string carries command-separator or
substitution syntax followed by download tools or shell binaries, as seen in command
injection against appliance management or API interfaces (for example Progress LoadMaster
CVE-2026-8037). The report gives no endpoint, so the rule matches the generic injection
pattern. Scope it to LoadMaster or other exposed appliance web logs.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: webserver
detection:
selection_sep_cmd:
cs-uri-query|contains:
- ;wget
- ;curl
- '|wget'
- '|curl'
- '%3bwget'
- '%3bcurl'
- '%7cwget'
- '%7ccurl'
- $(wget
- $(curl
- '`wget'
- '`curl'
- '%60wget'
- '%60curl'
- '%24%28wget'
- '%24%28curl'
- ;/bin/sh
- '|/bin/sh'
- '%3b/bin/sh'
- '%7c/bin/sh'
- ;/bin/bash
- '|/bin/bash'
- /dev/tcp/
condition: selection_sep_cmd
falsepositives:
- Vulnerability scanners and penetration tests against the appliance
- Web applications that legitimately pass shell-like snippets in query parameters,
such as documentation or code-sharing tools
level: medium
id: 48b890ca-c157-58b6-9e15-afebe482ed86
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/08/07/cisa-adds-one-known-exploited-vulnerability-catalog
Web Server Process Spawning Shell That Runs Download or Reverse Shell Commands on Linux
Detects a Linux web server or CGI process spawning a shell whose command line downloads a payload or opens a reverse shell. This indicates post-exploitation of command injection in a public-facing appliance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell That Runs Download or Reverse Shell Commands
on Linux
description: Detects a web server or CGI parent process (httpd, apache2, nginx, lighttpd,
php-fpm) spawning sh/bash with a command line that downloads and runs content or
opens a reverse shell. This is the post-exploitation pattern of command injection
in public-facing Linux appliances such as Progress LoadMaster.
tags:
- attack.execution
- attack.t1059
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /lighttpd
- /php-fpm
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- 'wget '
- 'curl '
- /dev/tcp/
- nc -e
- mkfifo
- base64 -d
- chmod +x
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Web-based admin panels that legitimately shell out to curl or wget for update checks
- CGI health-check scripts invoking curl against local services
level: high
id: ef8eb9fc-81bd-5ee2-b856-a2cd7fd9f077
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/08/07/cisa-adds-one-known-exploited-vulnerability-catalog
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/alerts/2026/08/07/cisa-adds-one-known-exploited-vulnerability-catalog
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs