Progress LoadMaster CVE-2026-8037: 792 Attacks Logged
Progress LoadMaster CVE-2026-8037, a CVSS 9.6 unauthenticated command-injection flaw, has already been hit with 792 confirmed exploitation attempts from 65 IP addresses over 41 days — and CISA added it to its Known Exploited Vulnerabilities catalog on August 7. If your load balancer is still running an unpatched build, the scanning has almost certainly already found it.
What Happened
CVE-2026-8037 is a command-injection vulnerability (CWE-77) in Progress Kemp LoadMaster’s management API. The root cause sits in the appliance’s own escape_quotes() function: a heap buffer is allocated but the escaped strings inside it are not properly null-terminated, producing an out-of-bounds read that lets attacker-controlled content flow straight into a shell command. No authentication, no credentials and no user interaction are required — a single crafted API request is enough to execute arbitrary commands with root-level access on the appliance.
Progress shipped the fix back in June, in LoadMaster GA 7.2.63.2 and LTSF 7.2.54.18. The vulnerability sat quietly for roughly two months before attackers caught on: CISA added CVE-2026-8037 to its KEV catalog on August 7, 2026, after confirming active exploitation, with a federal remediation deadline of August 10 under Binding Operational Directive 26-04 — a deadline that has already passed. Telemetry shows 792 distinct exploitation attempts from 65 IP addresses spread across a 41-day window, a pattern consistent with broad, automated internet-wide scanning rather than a single targeted campaign against one organization. Shadowserver counts roughly 300 LoadMaster instances still reachable from the internet with the management API exposed.
Why It Matters
A load balancer sits directly at the network edge, in front of exactly the applications an organization considers important enough to need one: ERP web portals, VPN concentrators, internal tools exposed for remote staff, customer-facing services. Root-level command execution on that appliance gives an attacker a foothold with visibility into every request the load balancer routes, plus a launchpad for lateral movement into whatever sits behind it. For German Mittelstand IT teams — who often run edge appliances like LoadMaster with lean or no dedicated 24/7 monitoring — a two-month gap between patch availability and mass exploitation is not a comfortable safety margin; it is the exact window this class of attack is designed to catch organizations still operating on a monthly-or-slower patch cadence.
What You Should Do Now
- Patch immediately: upgrade to LoadMaster GA 7.2.63.2 or LTSF 7.2.54.18 — both have been available since June, so this is a fix you may already have queued and not yet deployed.
- Verify: check whether your LoadMaster’s management API is reachable from the public internet at all; Shadowserver’s count of ~300 exposed instances suggests many organizations don’t realize theirs is one of them.
- Mitigate if you can’t patch today: restrict the management API to an internal management VLAN or VPN-only access immediately — do not leave it internet-facing while a patch window is scheduled.
- Monitor: review LoadMaster access logs for repeated malformed API requests matching the escape_quotes() exploitation pattern, and treat any unexplained command execution on the appliance as a confirmed compromise, not a false positive.
If your organization can’t confirm today whether the management API is internet-facing, that uncertainty is itself the finding — treat it as urgent.
DIESEC Perspective
This is the fourth distinct CISA KEV addition we’ve tracked in eight days across four completely different products — a pace most Mittelstand patch cycles simply cannot match on a monthly review schedule. Edge appliances like load balancers tend to get “set and forget” treatment once they’re working; this is the fourteenth network-edge product line we’ve covered being exploited at scale in 2026 alone, and the pattern keeps repeating because the treatment keeps repeating.
Not sure whether your organization’s edge appliances are actually being patched on the cadence attackers are now scanning on? Contact DIESEC for a rapid external exposure and patch-cadence review.
Sources: The Hacker News | BleepingComputer
Published: 2026-08-19 | Category: Vulnerabilities & Patches | ~4 min read
