CISA added CVE-2026-8037 — a critical unauthenticated command injection vulnerability in Progress Kemp LoadMaster — to its Known Exploited Vulnerabilities catalog on August 7, 2026, with a mandatory patching deadline of August 10 for Federal Civilian Executive Branch agencies. Threat actors have recorded 792 exploitation attempts against the flaw across 41 days, originating from 65 unique IP addresses spanning 18 countries.
What LoadMaster Is and Why It Matters
Kemp LoadMaster is a hardware and virtual application delivery controller used to distribute traffic across servers, provide SSL offloading, and manage application availability at scale. Progress Software reports over 100,000 LoadMaster deployments worldwide, with clients including the U.S. Air Force and organisations across 80% of the Fortune 500. The product sits in front of critical application infrastructure — web portals, internal APIs, healthcare applications, trading platforms, and communications services — making it a high-value target for initial access.
Technical Details
CVE-2026-8037 is a command injection vulnerability rooted in the escape_quotes() function within LoadMaster’s API handling layer. The function fails to properly sanitise user-supplied input before passing it to shell execution contexts, allowing an unauthenticated remote attacker to inject arbitrary commands with the privileges of the underlying operating system process.
The vulnerability carries a CVSS score of 9.6 (Critical). No authentication, no prior access, and no user interaction is required. An attacker with network access to the LoadMaster management interface can achieve full appliance compromise in a single request.
WatchTowr Labs published technical analysis of the flaw in June 2026, and a functional proof-of-concept became publicly available on June 29 — roughly six weeks before CISA’s KEV addition confirmed active exploitation. The lag between public exploit release and confirmed in-the-wild activity is consistent with the pattern observed for similar ADC vulnerabilities (F5 BIG-IP, Citrix NetScaler) where mass scanning follows exploit publication within days but destructive exploitation at scale may follow weeks later.
Exploitation Activity
eSentire telemetry captured 792 exploitation attempts over 41 days, with the most recent activity recorded on August 4. The 65 source IPs span 18 countries including Australia, China, Indonesia, Japan, Poland, and the United States. Attribution to a specific threat actor has not been confirmed; the geographic diversity of sources and the largely opportunistic targeting pattern suggests automated scanner activity rather than a targeted campaign. Lateral movement into downstream applications is the primary concern if initial access is achieved, given LoadMaster’s position in front of backend infrastructure.
Approximately 300 LoadMaster instances remain internet-exposed based on Shodan enumeration. Organisations that have constrained management interface access to internal networks are at substantially reduced risk.
Recommended Actions
Patch immediately. Progress Software released corrected versions in June 2026: GA v7.2.63.2 and LTSF v7.2.54.18 for LoadMaster; all versions at or below the prior GA for MOVEit WAF. Vendors with managed or hosted LoadMaster environments should confirm patch status with Progress directly.
Restrict management interface access. If patching is not immediately possible, restrict TCP access to the LoadMaster management interface to trusted administrative IP ranges. The vulnerability is exploitable only from network-accessible management endpoints.
Review logs for indicators. Examine LoadMaster access logs for anomalous API requests, particularly those targeting endpoints associated with configuration management. Unusual commands or connection patterns originating from external IP ranges warrant investigation.
Assess scope of backend exposure. Identify which applications, APIs, and internal services LoadMaster fronts in your environment. A compromised appliance may facilitate credential harvesting, session hijacking, or direct access to services behind the load balancer. Map this exposure as part of containment planning.
The pattern of ADC vulnerabilities being weaponised for initial access — Citrix NetScaler, F5 BIG-IP, Pulse Secure, and now LoadMaster — is well-established. Appliances of this type often receive less scrutiny than endpoint or server infrastructure despite sitting at a critical network boundary.