CVE-2026-8037: connection manager for objectscale before 7.2.63.2 (exclusive); +7 more affected products

Affected technology

connection manager for objectscale · before 7.2.63.2 (exclusive)
progress

ecs connection manager · before 7.2.63.2 (exclusive)
progress

moveit web application firewall · before 7.2.63.2 (exclusive)
progress

loadmaster · before 7.2.54.18 (exclusive)
progress

loadmaster · from 7.2.55.0 (inclusive), before 7.2.63.2 (exclusive)
progress

LoadMaster · V7.2.60.0 to before V7.2.63.2, V7.2.54.12 to before V7.2.54.18
Progress Software

ECS Connections Manager · V7.2.60.0 to before V7.2.63.2
Progress Software

Object Scale Connection Manager · V7.2.60.0 to before V7.2.63.2
Progress Software

MOVEit WAF · V7.2.60.0 to before V7.2.63.2
Progress Software

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Adjacent network · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An un-authenticated attacker can execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints. Vendor/CNA’s CVSS 3.1 assessment (base score 9.6/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high.