CISA Urges Immediate Patching of Exploited Progress LoadMaster Vulnerability

https://www.securityweek.com/wp-content/uploads/2025/07/CISA-KEV.jpg

The US cybersecurity agency CISA has urged federal agencies to immediately patch a critical-severity vulnerability in Progress Kemp LoadMaster that has been exploited in the wild.

Tracked as CVE-2026-8037 (CVSS score of 9.6), the flaw is described as an OS command injection that could be exploited without authentication for remote code execution (RCE).

According to Progress’ advisory, a remote attacker could exploit the bug through unsanitized API inputs to execute arbitrary commands on the LoadMaster appliance.

Disclosed on June 4 alongside CVE-2026-33691, the security defect also affects ECS Connection Manager, Connection Manager for ObjectScale, and MOVEit WAF.

“The specific flaw exists within the handling of the apiuser parameter provided to the accessv2 endpoint. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of root,” a ZDI advisory reads.

In-the-wild exploitation...

Copyright of this story solely belongs to securityweek.com. To see the full text click HERE

Read more

https://cdn.mos.cms.futurecdn.net/U8FDQjAxYmygvFzXAoLXzK-1920-80.jpg

'The next generation won’t replace this one so much as sit on top of it' — Industry analysts say Sony, Microsoft, and Nintendo's 'relentless push for higher-end performance will need to be moderated' to avoid $1000 launch consoles

* Several industry analysts say Sony and Microsoft may need to scale back their "relentless push for higher-end performance" to avoid $1000 consoles * Piers Harding-Rolls at Ampere Analysis says ambitions will need to be "moderated" to avoid breaching the hefty price point * Rhys Elliott at Alinea Analytics