Reported by 7 outlets
CISA Urges Immediate Patching of Exploited Progress LoadMaster Vulnerability
Why this score
- Breadth
- 2.00 / 2.0 · 7 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.01 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CVE-2026-8037 is an unauthenticated command-injection RCE (CWE-77, CVSS 9.8 per NVD, 9.6 per Progress) in Progress Kemp LoadMaster GA v7.2.63.1 and older and LTSF v7.2.54.17 and older, reachable with a single POST to /accessv2 when the management API is enabled. The flaw sits in escape_quotes(), which copied attacker input into a buffer allocated with malloc() and never null-terminated it: the request's JSON keys spray heap chunks with command strings, and four single quotes in apiuser expand into sixteen escaped bytes that overwrite the neighboring chunk's allocator metadata, so the shell command assembled for system() reads straight into attacker-controlled content. TrendAI researcher Syed Ibrahim Ahmed found the bug (ZDI-26-342, June 9, 2026), Progress patched it in GA v7.2.63.2 and LTSF v7.2.54.18, WatchTowr Labs published a working exploit on June 29, eSentire saw exploitation attempts the same day, and CISA KEV-listed it on August 7 with a federal due date of August 10.
The number that matters here is not the CVSS score, it is the nine weeks between patch availability on June 4 and the KEV listing on August 7, combined with exploitation starting within one day of public PoC. LoadMaster is an edge appliance that terminates TLS and routes traffic for everything behind it, so unauthenticated root-level code execution on it is a foothold placed in front of the firewall, usually holding cached credentials and full visibility of backend application flows. Any organization that patched only after the KEV headline must treat the appliance as touched sometime since June, and CISA's decision to require forensic triage under BOD 26-04 states exactly that: applying the firmware answers the vulnerability question, not the compromise question. The blast radius is wider than the load balancer fleet, since the same bulletin's second flaw, CVE-2026-33691, defeats the appliance's WAF file-upload checks, and Progress applies both CVEs to MOVEit WAF as well.
Upgrade to GA v7.2.63.2 or LTSF v7.2.54.18 (v7.2.63.2 for ECS Connection Manager and Connection Manager for ObjectScale where deployed), confirming the version string in the web UI's top-right corner or on the boot console. Restrict the management API and /accessv2 to administration networks, since internet-exposed instances are the ones attackers can reach without credentials. For hunting, review appliance access logs for POST /accessv2 requests carrying apiuser values with runs of single quotes or unusually large JSON bodies packed with many repeated keys, and check shell or audit logs for unexpected processes spawned by the access binary or invocations of validuser. Block eSentire's reported attacker IPs 192.42.116.58, 192.42.116.105 and 146.70.139.154, and if the patch landed after August 7, run CISA's forensic triage path against the appliance rather than assuming it is clean.
Two developments would change the assessment. Confirmation of successful exploitation, or ransomware operators adopting the exploit, would move this from attempted-intrusion to confirmed-breach territory, since KEV currently lists ransomware use as Unknown and every attempt eSentire observed failed. Evidence of exploitation predating the June 29 PoC would push the compromise window back to the June 4 disclosure, meaning even June patchers would need to re-run triage.
Timeline
-
original reporting
CISA Urges Immediate Patching of Exploited Progress LoadMaster Vulnerability
securityweek.com · 64d ago · August 10th, 2026
-
update from nvd.nist.gov
NVD record for CVE-2026-8037 (published 2026-06-04)
nvd.nist.gov · 131d ago · June 4th, 2026
The NVD record for CVE-2026-8037 was published on June 4, 2026, describing an OS command injection RCE in Progress ADC products that lets an unauthenticated attacker execute arbitrary commands on the LoadMaster appliance via unsanitized input in multiple command endpoints. NVD scores it 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-77); Progress's own score is 9.6 with an adjacent-network vector.
-
update from zerodayinitiative.com
ZDI-26-342: Progress LoadMaster apiuser Uninitialized Memory Remote Code Execution Vulnerability (Zero Day Initiative)
zerodayinitiative.com · 127d ago · June 9th, 2026
Zero Day Initiative published the coordinated advisory for CVE-2026-8037 on June 9, 2026, crediting Syed Ibrahim Ahmed of TrendAI Research. Its disclosure timeline records the vulnerability was reported to the vendor on April 15, 2026, roughly seven weeks before the coordinated public release. The advisory frames the flaw as an uninitialized memory condition in the LoadMaster API's apiuser handling that leads to remote code execution.
-
update from esentire.com
eSentire TRU: Progress Kemp LoadMaster Vulnerability Targeted (CVE-2026-8037)
esentire.com · 106d ago · June 30th, 2026
eSentire's Threat Response Unit reported that beginning June 29, 2026, one day after the WatchTowr PoC release, it identified exploitation attempts targeting CVE-2026-8037; in observed cases exploitation was not successful and no post-compromise activity was seen. The advisory lists attacker IPs 192.42.116.58, 192.42.116.105 and 146.70.139.154, and assesses exploitation attempts will increase given the availability of PoC code. Affected and fixed versions match the Progress bulletin (GA 7.2.63.1 to 7.2.63.2, LTSF 7.2.54.17 to 7.2.54.18).
-
update from community.progress.com
LoadMaster Critical Security Bulletin - June 2026 (CVE-2026-8037, CVE-2026-33691)
community.progress.com · 75d ago · July 31st, 2026
The Progress Kemp LoadMaster vendor bulletin, which WatchTowr and eSentire date to a June 4, 2026 disclosure and which now carries a July 31, 2026 page date, describes critical CVE-2026-8037 (command injection RCE in the API) and high CVE-2026-33691 (whitespace padding in filenames bypasses OWASP CRS file upload extension checks via crafted multipart requests). It affects Kemp LoadMaster GA v7.2.63.1 and older and LTSF v7.2.54.17 and older, fixed in GA v7.2.63.2 and LTSF v7.2.54.18, with the same CVEs also covered for ECS Connection Manager and Connection Manager for ObjectScale at v7.2.63.2. At publication Progress stated it had no reports of exploitation and no known indicators of compromise.
-
update from cisa.gov
CISA Known Exploited Vulnerabilities Catalog: Progress LoadMaster Command Injection Vulnerability
cisa.gov · 68d ago · August 7th, 2026
CISA added CVE-2026-8037 to the KEV catalog on August 7, 2026 with a federal remediation due date of August 10, 2026, citing an unauthenticated command injection via unsanitized input in multiple command endpoints. The entry requires compliance with CISA's Forensics Triage Requirements under BOD 26-04 and lists known ransomware campaign use as Unknown.
-
update from cyberpress.org
CISA warns Actively Exploited Progress Kemp LoadMaster RCE Flaw
cyberpress.org · 64d ago · August 10th, 2026
Cybersecurity and Infrastructure Security Agency (CISA) has added a critical command-injection vulnerability affecting Progress Kemp LoadMaster appliances to its Known Exploited Vulnerabilities (KEV) Catalog, warning that the flaw is being actively exploited in the wild. Progress LoadMaster is an application delivery controller and load balancer commonly deployed at the network edge to distribute application traffic, provide SSL offloading, and manage availability. Progress Kemp LoadMaster RCE Flaw Exploited Its location and access to backend infrastructure make a compromise particularly consequential: attackers could potentially use a breached appliance as an entry point for reconnaissance, credential theft, lateral movement, or persistence. CVE-2026-8037 is classified as CWE-77, or improper neutralization of special elements used in an operating-system command. By submitting specially crafted requests, an attacker may inject shell commands and have them executed by the underlying appliance without needing valid credentials. The vulnerability has been described as a pre-authentication remote code execution issue, meaning internet-exposed instances are at the highest risk. Technical analysis ha