CISA adds Progress LoadMaster flaw to exploited vulnerabilities catalog

By Atlas Watchline Staff · Regulatory · August 7, 2026

CISA said it added CVE-2026-8037, a Progress LoadMaster command injection flaw, to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation.

CISA said on Aug. 7 that it added CVE-2026-8037, a Progress LoadMaster command injection vulnerability, to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation.

CISA said the catalog flags flaws that present a higher risk to federal systems and other organizations. The agency said vulnerabilities of this kind are a frequent attack vector for malicious cyber actors and can pose significant risks to the federal enterprise.

The catalog entry falls under Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk. The directive sets vulnerability management requirements for Federal Civilian Executive Branch agencies and calls for rapid remediation of high-risk vulnerabilities, especially CVEs listed in the KEV Catalog on publicly exposed assets that could give an attacker total control after exploitation.

The directive also sets expectations for when agencies must determine whether threat actors compromised a system before a patch was applied. CISA said BOD 26-04 applies only to FCEB agencies, but it encouraged all organizations to use risk-based vulnerability management and to prioritize remediation of KEV Catalog items.

CISA said it will keep adding vulnerabilities that meet the catalog’s criteria. It also asked people who know of an exploited vulnerability that is not listed to submit it through CISA’s KEV Nomination Form. The agency said potential additions must have a CVE ID, evidence of exploitation and clear mitigation guidance.

Sources

• CISA alert page
• CISA RSS item

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.