CVE -2026-8037, a critical vulnerability in Progress Kemp LoadMaster, has been added to CISA's Known Exploited Vulnerabilities (KEV) list after documented exploitation attempts. The flaw allows unauthenticated remote attackers to execute arbitrary commands on the device.
The listing concerns a command injection with a CVSS score of 9.6. CISA says the vulnerability lies in inadequately filtered input to multiple command points, so an attacker would not need valid credentials to attempt the attack.
See also: Progress Kemp LoadMaster: Critical root command execution vulnerability
Attempts to exploit CVE-2026-8037 in LoadMaster
LoadMaster acts as a load balancer and gateway for critical services, so a breach of it could provide access to a central point in the infrastructure. The current report from The Hacker News links the addition of CVE-2026-8037 to KEV to reports of attacks recorded online.
The technical analysis published earlier describes the escape_quotes(), which handles user-entered data. Inadequate string handling can lead to command injection to the operating system. The result is the ability to execute commands, even without first logging into the admin panel.
eSentire had detected exploitation attempts since June 29, after the release of proof of concept code. The company noted that most attempts were unsuccessful, but the existence of public code and the exposure of the device to the internet significantly increases the pressure for immediate action.
792 exploitation attempts in 41 days
According to KEVIntel telemetry, 792 exploitation attempts over 41 days. The attempts came from 65 unique IP addresses in 18 countries, with the most recent activity reported in the report occurring on August 4th, with five attempts.
The report for CVE-2026-8037 lists three addresses that eSentire detected: 192.42.116[.]58, 192.42.116[.]105, and 146.70.139[.]154. These indications do not in themselves prove a successful compromise of each device, but are useful evidence for log review and detection rules.
The location of the device within the network also matters for CVE-2026-8037 . A LoadMaster that handles traffic to multiple applications is a prime target because its compromise can impact confidentiality and service availability simultaneously
See also: OpenYak RCE: Critical vulnerability in local API leads to code execution
CISA has given U.S. federal civil services until August 10, 2026 to implement the necessary fixes, as part of BOD 26-04. While the deadline is specific to the U.S. public sector, KEV membership is a strong red flag for any organization using LoadMaster.
The audit should cover both production devices and backup environments, because an old version may remain active without being visible from the central repository. Recording the actual exposure is essential before any conclusion can be drawn.
Corrections and direct checks
Progress' official documentation lists LMOS versions 7.2.63.2 and 7.2.54.18 as fixed, while prior versions are considered vulnerable. Administrators should confirm the version they are running and follow the manufacturer's instructions before upgrading.
For CVE-2026-8037, Progress says the issue affects the user interface and API of the cipher set function and was fixed with changes that prevent remote command execution. The update should not be limited to a version check: it requires a parallel search for unusual commands, new accounts, configuration changes, and access from unexpected addresses.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
After installing the patch, security teams should compare before-and-after logs, review remote management settings, and confirm that there are no unknown configuration changes. This process helps distinguish a simple attempt from a potential breach.
Where immediate upgrade is not possible, the SecNews technical team recommends restricting access to the management interface, disabling non-essential services, and enforcing access only from trusted networks. These measures do not replace the official fix, but reduce the attack surface until the change is complete.
See also: Bouncy Castle FIPS: CVE-2026-13505 delays key deletion
The listing of CVE-2026-8037 in KEV, the repeated attempts, and the public technical knowledge surrounding the flaw create conditions that cannot be postponed. Organizations should immediately review the LoadMaster report, install the patched versions, and examine logs for evidence of previous activity.
