CVE-2026-8037: Progress Kemp LoadMaster Command Injection Exploited in the Wild. 792 Attempts in 41 Days

Progress Kemp LoadMaster command injection CVE-2026-8037 (CVSS 9.6) added to CISA KEV on 8 Aug 2026. 792 exploit attempts from 65 IPs in 18 countries over 41 days. watchTowr and eSentire observed active attacks. Federal agencies must patch by 10 Aug.

On 8 Aug 2026, CISA added Progress Kemp LoadMaster command injection CVE-2026-8037 (CVSS 9.6) to the Known Exploited Vulnerabilities catalog (KEV). FCEB agencies must remediate by 10 Aug 2026 under BOD 26-04. The flaw sits in `escape_quotes()` on the LoadMaster command-handling interface. Insufficient input sanitization lets unauthenticated attackers inject arbitrary commands and run OS commands with no credentials. Threat intel from KEVIntel and watchTowr recorded 792 exploit attempts over 41 days from 65 unique IPs in 18 countries, including Australia, China, Indonesia, Japan, Poland, and the United States. Last observed activity: 4 Aug.

Overview

watchTowr Labs identified the LoadMaster command injection in a June 2026 analysis. eSentire tracked related attempts over recent months with low success rates. In early Aug 2026 the attacker IP pool expanded. Per eSentire, activity clustered on `192.42.116[.]58`, `192.42.116[.]105`, and `146.70.139[.]154`. Likely commercial proxies or VPN abuse. With CISA KEV listing, unpatched internet-facing LoadMaster nodes face mass scanning.

Technical details

Root cause is LoadMaster `escape_quotes()`. Crafted REST calls pass unescaped special characters into command-line concatenation. Result: command injection. Affected branches:

• LoadMaster 7.2 series: all versions below 7.2.62;
• LoadMaster 7.1 series: all versions below 7.1.36;
• LTS: some LTS branches below 7.1.35.4;
• Virtual / hardware / OEM: all deployments sharing 7.x kernel code, including Multi-Tenant (MT) and software-defined editions.

LoadMaster typically sits at the enterprise edge or public-cloud load-balancer ingress. Successful exploit yields ADC takeover: traffic reroute, TLS decryption, or backend access. watchTowr PoC shows unauthenticated RCE. No credentials. No interaction. Progress shipped patched builds and alerts. Confirm the exact fix ID in the PSIRT advisory.

Impact

LoadMaster handles internet ingress and TLS offload in finance, telecom, healthcare, government, and e-commerce. Edge placement, high visibility, large blast radius. Attackers treat it as a high-value pivot. Compromise enables:

• Rewrite load-balancer config and steer users to attacker-controlled nodes;
• Unwrap encrypted sessions and push MITM TLS certificates;
• Abuse ADC trust to the backend for lateral movement into clusters and databases;
• Use the ADC as a covert proxy or C2 forwarder.

CISA KEV listing plus watchTowr and KEVIntel telemetry show the shift from opportunistic scanning to targeted exploitation. Exposed devices are at immediate risk.

Mitigation

• Patch now: upgrade LoadMaster to the vendor-fixed release. Verify firmware hash and signature from the SM advisory.
• Network reduce: bind management ports (default 443 / 8443) and the REST API to an internal management network. Block internet access. Enable IP allow-list and VPN-fronted login.
• WAF / IPS: deploy WAF rules targeting the `escape_quotes()` path. Temporarily reject malformed parameters and oversized fields.
• Detection: ship LoadMaster syslog to SIEM. Correlate unusual user-agent → management interface → abnormal-length POST. Hunt unauthorized access on REST /admin/.
• Incident: for suspected compromise, full firmware reflash and certificate restore via `non-credentialed recovery`. Do not patch in place. Persistence is likely.

References

• The Hacker News Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts
• CISA Known Exploited Vulnerabilities Catalog
• NVD CVE-2026-8037
• Progress Kemp LoadMaster official security advisory (source mapping)
• watchTowr Labs original technical analysis