CISA Adds CVE-2026-8037 Progress LoadMaster Command Injection to Known Exploited Vulnerabilities Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-8037 to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. The vulnerability affects Progress LoadMaster, a load balancing and application delivery controller platform. Command injection vulnerabilities are a frequent attack vector for malicious cyber actors, and exploitation could allow total control of affected assets that are publicly exposed.

CISA's Binding Operational Directive (BOD) 26-04, "Prioritizing Security Updates Based on Risk," establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. The directive reinforces the importance of the KEV Catalog and requires agencies to prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets that grant total control of the asset post-exploitation. BOD 26-04 also establishes expectations for agencies to check whether threat actors compromised the system before the patch was applied.

While the BOD applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria of a CVE ID and evidence of exploitation. Organizations aware of exploited vulnerabilities not currently listed are encouraged to submit them via CISA's KEV Nomination Form.

Progress LoadMaster users are advised to apply vendor-provided patches immediately. Federal agencies must follow the remediation timelines and pre-patch compromise checks outlined in BOD 26-04.