Reported by 5 outlets
Progress Kemp LoadMaster Joins CISA KEV — Unauthenticated Command Injection Under Attack
Why this score
- Breadth
- 2.00 / 2.0 · 5 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CVE-2026-8037 (CVSS 9.6, CWE-77) is an unauthenticated command injection in the Kemp LoadMaster API, reachable through the /accessv2 endpoint. The escape_quotes() helper allocates its output buffer with malloc and never writes a null terminator, so the escaped apiuser value runs past its allocation when it is spliced into a validuser command line handed to system(). watchTowr's June 29 exploit shows the mechanics: apiuser set to four single quotes expands to 16 escape bytes that overwrite heap allocator metadata, while dozens of sprayed JSON parameters carry the command payload into the adjacent chunk. Affected builds are GA v7.2.63.1 and older and LTSF v7.2.54.17 and older with the API enabled, plus MOVEit WAF before GA v7.2.63.2. CISA added the bug to the KEV catalog on August 7; eSentire telemetry recorded 792 exploitation attempts over 41 days from 65 IPs across 18 countries, largely unsuccessful, starting in July.
The exposure math argues this is a targeting problem, not a scanning problem. Shadowserver counts roughly 300 internet-exposed LoadMaster appliances against the vendor's claim of more than 100,000 deployments and customers including Amazon and the U.S. Air Force, so 792 attempts from just 65 source IPs indicates aimed probing of a small, high-value population rather than background noise. The more uncomfortable fact is the timeline: Progress's June 4 bulletin stated no exploitation and no indicators of compromise, watchTowr published a working pre-auth exploit on June 29, and CISA only confirmed in-the-wild exploitation on August 7. That is 39 days in which the exploit was public while the vendor stance said quiet, and any organization that triaged the June advisory as patch-when-convenient owned that window. A compromised load balancer is worse than a compromised server: it terminates TLS in front of the application tier, which means session keys, the ability to redirect or drop traffic, and a persistence point most monitoring was never pointed at.
Remediation is unambiguous. Upgrade LoadMaster to GA v7.2.63.2 or LTSF v7.2.54.18, the fixed builds in the Progress bulletin, and apply v7.2.63.2 to MOVEit WAF, ECS Connection Manager and Connection Manager for ObjectScale. Restrict the API and management interface away from the internet and disable the API entirely where it is unused, since the flaw requires it. The KEV entry carries CISA's forensic triage requirement with an August 10 BOD 26-04 deadline for federal civilian agencies, and unpatched internet-facing appliances should get the same treatment anywhere else. Hunt in reverse proxy and web access logs for POST requests to /accessv2 with apiuser values containing four consecutive single quotes or the '\'' escape sequence, JSON bodies holding dozens of repeated keys in the g0, g1 pattern used for heap spray, and command fragments following quote escapes. Confirm the running version from the string in the web UI top-right corner or the boot console rather than trusting inventory.
Two developments would change this assessment. First, any confirmation of successful compromise, a vendor notice, incident report or attribution moving past eSentire's largely-unsuccessful telemetry, would turn a patching story into an incident response story, and the KEV entry's forensic triage flag shows CISA is already braced for that. Second, a ransomware-use designation, currently listed as Unknown in the catalog, or exploitation appearing against MOVEit WAF specifically, would widen the blast radius across the same product line that turned MOVEit Transfer into a mass initial-access vector.
Timeline
-
original reporting
Progress Kemp LoadMaster Joins CISA KEV — Unauthenticated Command Injection Under Attack
thehackernews.com · 66d ago · August 9th, 2026
CISA added CVE-2026-8037 (CVSS 9.6) to its Known Exploited Vulnerabilities catalog on August 7, citing active exploitation of an unauthenticated command injection in Progress Kemp LoadMaster that lets attackers run arbitrary commands on the appliance without credentials — rooted in a flawed escape_quotes() function per watchTowr Labs. Telemetry logged 792 exploitation attempts over 41 days from 65 unique IPs across 18 countries, with eSentire documenting largely unsuccessful attacks as early as July. Federal agencies face an August 10 BOD 26-04 deadline; treat every internet-facing LoadMaster as a priority patch and audit for post-exploitation artifacts.
-
update from progress.com
LoadMaster Critical Security Bulletin - June 2026 (CVE-2026-8037, CVE-2026-33691) (Progress Software)
progress.com · 132d ago · June 4th, 2026
Progress's June 2026 bulletin, which watchTowr dates to June 4 (the community page itself carries a July 31, 2026 last-modified stamp), covers critical command injection CVE-2026-8037 in the LoadMaster API and high-severity CVE-2026-33691, an OWASP Core Rule Set whitespace-padded filename bypass of file upload extension checks. It affects GA v7.2.63.1 and older, LTSF v7.2.54.17 and older, plus ECS Connection Manager and Connection Manager for ObjectScale v7.2.63.1 and older, fixed in GA v7.2.63.2 and LTSF v7.2.54.18. At publication Progress stated it had received no reports of exploitation and knew of no indicators of compromise; a companion MOVEit WAF bulletin covers the same two CVEs.
-
update from watchtowr.com
Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037) (watchTowr Labs)
watchtowr.com · 107d ago · June 29th, 2026
watchTowr's Sina Kheirkhah published the full technical analysis on June 29, 2026, showing the June patch's only functional changes to escape_quotes() were malloc becoming calloc and a missing null terminator being added. The vulnerable code splices the unterminated escaped apiuser value into a validuser command line executed via system(), so their exploit POSTs to /accessv2 with apiuser set to four single quotes, whose escape expansion overwrites 16 bytes of heap allocator metadata, while sprayed JSON parameters carry the command payload, yielding pre-auth RCE without any credentials.
-
update from bleepingcomputer.com
Progress Kemp LoadMaster Command Injection Under Active Attack — Federal Deadline Lands Today
bleepingcomputer.com · 65d ago · August 10th, 2026
CISA's KEV catalog entry for CVE-2026-8037 (CVSS 9.6), the unauthenticated command injection in Progress Kemp LoadMaster rooted in unsanitized API inputs across multiple command endpoints, carries a BOD 26-04 remediation deadline of today for US federal agencies — and Shadowserver counts nearly 300 internet-exposed LoadMaster appliances. Progress patched the flaw in June (GA v7.2.63.1 or newer, LTSF v7.2.54.17 or newer), and confirmed all MOVEit WAF versions before GA v7.2.63.2 are also affected. The ADC is embedded in critical infrastructure — Progress says 80% of the Fortune 500 and more than 100,000 organizations run it — so every internet-facing appliance should be treated as a priority patch and audited for post-exploitation artifacts.
-
update from bleepingcomputer.com
Critical Progress LoadMaster flaw now actively exploited in attacks
bleepingcomputer.com · 64d ago · August 10th, 2026
Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are exploiting a critical-severity Progress Kemp LoadMaster command injection vulnerability. Kemp LoadMaster is a very popular Application Delivery Controller (ADC) and server load balancer used by tech companies and government entities worldwide (e.g., Amazon, U.S. Air Force) to distribute incoming web traffic across multiple servers, optimize app performance, and ensure high service availability. According to Internet threat watchdog Shadowserver, nearly 300 Kemp LoadMaster instances are exposed online. However, there is no information regarding how many of them are honeypots or have already been secured against CVE-2026-8037 attacks. Federal Civili
-
update from gbhackers.com
CISA Flags Progress LoadMaster Command Injection Vulnerability Exploited in the Wild
gbhackers.com · 64d ago · August 10th, 2026
CVE/vulnerability Cyber Security News Vulnerability 2 min. This vulnerability allows unauthenticated attackers to execute arbitrary commands on vulnerable appliances, posing a significant risk to organizations that expose LoadMaster management services to the internet. CISA added the vulnerability to the KEV catalog on August 7, 2026, and instructed Federal Civilian Executive Branch agencies to implement vendor mitigations by August 10, as mandated by Binding Operational Directive 26-04. The agency also urges defenders to evaluate their exposure to the internet, adhere to forensic triage requirements, and cease using the products when suitable mitigations are unavailable. Progress LoadMaster Command Injection Vulnerability CVE-2026-8037 is classified as CWE-77, which refers to the improper neutralization of special elements used in an operating system command. The issue arises in API endpoints within Progress ADC products, including LoadMaster, where unsanitized input can be used to execute operating-system commands. Consequently, an attacker does not need valid appliance credentials to exploit this vu