CVE-2026-8037: Progress Kemp LoadMaster Pre-Auth RCE (CVSS 9.8) Added to CISA KEV — Patch to 7.2.63.2 Now

CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalog this week, following confirmed active exploitation of a critical unauthenticated command injection flaw in Progress Kemp LoadMaster. The flaw allows an unauthenticated attacker to execute arbitrary operating system commands as root — without valid credentials, without network-level access controls bypassing, and with a publicly available proof-of-concept that has been circulating since late June.

If you operate a Kemp LoadMaster appliance with its API enabled and have not yet applied the June patch, your load balancer is likely already in someone's exploitation queue.

What Is Progress Kemp LoadMaster

LoadMaster is an application delivery controller — a load balancer — widely deployed in enterprise networks to distribute traffic across application servers, terminate TLS, and provide layer-7 health checks. It's common in mid-market and enterprise environments across BFSI, healthcare, government, and technology sectors. Because load balancers sit in front of application infrastructure and are directly reachable from the internet or DMZ, a pre-auth RCE on a load balancer is particularly damaging: the attacker gains a privileged position in the network without ever touching an application server.

Vulnerability Details

CVE-2026-8037 is an unauthenticated OS command injection in the LoadMaster API. The flaw lives in the escape_quotes() function — a sanitisation routine that is supposed to clean user-supplied input before it is passed to a shell command. It doesn't. A specially crafted request to the /accessv2 API endpoint triggers an out-of-bounds heap read and command injection, handing the attacker arbitrary command execution as root.

The vulnerability is pre-authentication. No credentials, no session token, no prior access is required. A single HTTP request to the API endpoint with a crafted payload is sufficient to achieve root code execution on the appliance.

Affected versions: LoadMaster GA 7.2.63.1 and older, and LoadMaster LTSF 7.2.54.17 and older. The fixed releases — GA 7.2.63.2 and LTSF 7.2.54.18 — were issued by Progress in June 2026.

The CVSS score is 9.8 (critical) per ZDI's assessment, reflecting the pre-authentication nature, root-level impact, and network-accessible attack vector with no user interaction required.

Exploitation Timeline

Progress published its security advisory on June 4, 2026. On June 29, researchers at watchTowr Labs published a detailed technical write-up walking through the full exploit chain. Exploitation attempts began the same day the PoC dropped — a pattern security teams have seen repeatedly in 2026 as the window between disclosure and weaponisation has collapsed to near-zero.

eSentire's Threat Response Unit identified exploitation attempts beginning June 29. By the time CISA added the vulnerability to the KEV catalog in August, 792 confirmed exploitation attempts had been recorded over 41 days, originating from 65 unique IP addresses across 18 countries. The multi-country, multi-IP origin profile is consistent with automated scanning infrastructure rather than targeted, manual exploitation — which means any internet-exposed LoadMaster is being probed, not just high-value targets.

What Attackers Can Do With Root RCE on a Load Balancer

An attacker with root access on a LoadMaster can do several things that are particularly damaging to enterprise security. They can intercept and inspect all traffic passing through the load balancer — including decrypted TLS sessions if TLS termination is configured. They can modify routing rules to redirect traffic to attacker-controlled infrastructure. They can use the load balancer as a pivot point to reach backend application servers on internal network segments. They can install persistent backdoors or implants that survive appliance reboots. And because load balancers often hold TLS private keys and service account credentials, the exfiltration impact extends beyond the appliance itself.

In short, a compromised load balancer is a compromised network perimeter.

Patch Now: Immediate Steps

Every organisation running Progress Kemp LoadMaster must take the following steps today:

Identify all LoadMaster instances. Check both physical and virtual deployments. If you use LoadMaster Cloud (hosted on Azure or AWS), determine whether your version is in the affected range.

Apply the patch immediately. Upgrade to LoadMaster GA 7.2.63.2 or LTSF 7.2.54.18. Progress issued these patches in June — there is no legitimate reason to be running the vulnerable version in August.

Restrict API access. If you have LoadMaster deployments where the API is enabled and accessible from untrusted network segments or the internet, restrict API access to known management IP ranges via firewall rules, even if you have patched. Defence in depth applies.

Review appliance logs for exploitation indicators. Look for anomalous requests to the /accessv2 endpoint, unexpected outbound connections from the appliance, and changes to routing configuration that were not made by your team. If you find evidence of compromise, treat the appliance as fully owned — restore from a known-clean backup or rebuild from scratch and rotate all credentials the appliance held.

Verify your patch with a scan. Do not assume patching worked. Run a vulnerability scan against your LoadMaster instances to confirm the fixed version is in place.

Federal Civilian Executive Branch agencies were required by CISA to apply this patch by August 10, 2026. If you operate in a regulated industry — BFSI, healthcare, or a government supply chain — the same urgency applies to you even without a federal mandate.

Why VAPT Must Include Network Infrastructure

CVE-2026-8037 illustrates a gap that most annual penetration tests don't close: load balancers, firewalls, and other network appliances are frequently excluded from VAPT scope because they're "infrastructure, not application." This is a mistake. Network appliances running outdated firmware or vulnerable management APIs represent exactly the kind of pre-auth, root-level exposure that attackers prioritise because they sit in front of everything else.

Alastor Pulse includes network infrastructure in its continuous testing scope, covering load balancers, API gateways, and appliance management interfaces. Our Enforster AI scanning engine runs continuous version detection and known CVE matching against network-facing services, so CVE-2026-8037 would have been flagged in your environment the day the advisory dropped — not three months later during an annual engagement.

If you need help verifying whether your LoadMaster deployment is patched, or want to run an emergency scope assessment of your network perimeter, contact us at support@alastorinfosec.com or visit Alastor Pulse.

CVE-2026-8037 is a pre-auth root RCE on a device that sits in front of your entire application stack — if your LoadMaster is not on version 7.2.63.2 or 7.2.54.18, patching it is the most important security action you can take today.