Urgent: Critical Remote Code Execution Vulnerability in Progress Kemp LoadMaster (CVE-2026-8037)

A critical security vulnerability has been identified in Progress Kemp LoadMaster, a widely used Application Delivery Controller (ADC) and load balancer. Tracked as CVE-2026-8037, this flaw allows unauthenticated remote attackers to execute arbitrary commands on the affected appliance, potentially leading to a complete system takeover. Given its position at the edge of the network, a compromise of a LoadMaster appliance provides attackers with a significant foothold for lateral movement into internal systems.

The Vulnerability: OS Command Injection

The flaw is an OS command-injection vulnerability located in the LoadMaster management API. Specifically, it stems from the improper handling of user-supplied input within the escape_quotes() function used by the load balancer’s web interface and API. When an attacker sends a specially crafted request to the /accessv2 API endpoint, the system fails to properly sanitize the input, leading to an out-of-bounds read into adjacent heap memory.

Attackers can exploit this memory corruption to spray command-injection payloads into the affected memory segments. Because the system subsequently executes these strings using the system() function, the attacker can achieve remote code execution (RCE) with shell privileges—all without requiring any prior authentication or valid credentials.

Affected Systems and Software

This vulnerability impacts several versions of the Progress Kemp LoadMaster firmware. Organizations utilizing the following versions are at risk:

• Progress Kemp LoadMaster (GA Train): Versions 7.2.63.1 and prior
• Progress Kemp LoadMaster (LTSF Train): Versions 7.2.54.17 and prior

While the primary focus is on LoadMaster, the underlying vulnerability may also affect related products in the Progress ADC portfolio, such as ECS Connection Manager and Object Scale Connection Manager. It is critical for administrators to inventory all Progress-branded network appliances to determine their exposure.

Severity and Active Exploitation

CVE-2026-8037 has been assigned a CVSS score of 9.8 (Critical). This reflects the high impact of the vulnerability and the ease of exploitation, as it requires no user interaction and no authentication.

The threat is not theoretical. Following the publication of technical analysis and functional Proof-of-Concept (PoC) code in late June 2026, security researchers and telemetry data have confirmed active exploitation attempts in the wild. Attackers are actively scanning for vulnerable LoadMaster instances to gain initial access to enterprise environments. Consequently, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-8037 to its Known Exploited Vulnerabilities (KEV) catalog on August 7, 2026, mandating that federal agencies apply patches immediately.

Mitigation and Remediation Steps

The most effective and recommended remediation is to apply the security updates released by Progress. Organizations should upgrade their LoadMaster appliances to the following resolved versions:

• LoadMaster GA Train: Upgrade to version 7.2.63.2 or later.
• LoadMaster LTSF Train: Upgrade to version 7.2.54.18 or later.

In addition to patching, security teams should consider the following best practices:

• Forensic Triage: Before patching, examine system logs and network traffic for indicators of compromise (IoCs). Specifically, look for unusual POST requests targeting the /accessv2 endpoint. Patching fixes the hole but does not remove an attacker who has already gained access.
• Restrict Management Access: Ensure that the LoadMaster management interface and API are not exposed directly to the public internet. Access should be restricted to trusted internal networks or secured via a VPN.
• Monitor for Anomalous Activity: Implement robust monitoring for any unexpected shell execution or unusual outbound network connections from the LoadMaster appliance.

With active exploitation currently underway, there is no time to delay. Administrators should treat this as a high-priority emergency and apply the necessary firmware updates immediately to secure their network perimeter.