Critical RCE Vulnerability in Progress Kemp LoadMaster (CVE-2026-8037) Under Active Exploitation

Executive Summary

An urgent threat is facing users of Progress Kemp LoadMaster, as a critical, unauthenticated remote code execution (RCE) vulnerability, CVE-2026-8037, is now under active exploitation. This command injection flaw, which can be rated up to 9.8 on the CVSS scale, allows attackers to execute arbitrary commands as the root user on vulnerable appliances. The attack is delivered via a crafted request to the device's API. The risk is exceptionally high as a public proof-of-concept (PoC) exploit is available, and security firm eSentire has confirmed observing exploitation attempts. Organizations must prioritize applying the available patches to prevent a full compromise of their network perimeter.

Vulnerability Details

CVE-2026-8037 is an OS command injection vulnerability in the API of the Kemp LoadMaster load balancer. The flaw exists in the /accessv2 API endpoint due to insufficient sanitization of user-supplied input within the escape_quotes() function. An unauthenticated attacker can send a malicious request containing crafted command strings. These strings are passed directly to the underlying operating system and executed with root privileges. Since LoadMaster devices are typically deployed as edge devices to manage and secure traffic to critical backend applications, a successful exploit provides an attacker with a powerful foothold on the network perimeter.

Affected Systems

The vulnerability affects the following versions of Progress Kemp LoadMaster:

• GA version 7.2.63.1 and older
• LTSF version 7.2.54.17 and older

Progress has released patched versions GA v7.2.63.2 and LTSF v7.2.54.18 to address the issue.

Exploitation Status

This vulnerability is actively being exploited. Following the release of patches by Progress on June 4, 2026, researchers from watchTowr Labs published a technical deep-dive and a working PoC exploit on June 29. On the very same day, eSentire's Threat Response Unit (TRU) detected active exploitation attempts against its customer base. This rapid turnaround from PoC to active attack highlights the significant danger posed by this flaw.

Impact Assessment

The impact of exploiting CVE-2026-8037 is severe. An attacker can achieve the following:

• Complete Device Takeover: Gaining root access means full control over the LoadMaster appliance.
• Traffic Interception and Manipulation: Attackers can intercept, inspect, and modify all traffic passing through the load balancer, including sensitive data.
• Internal Network Access: The compromised device can be used as a pivot point to launch further attacks against the internal network.
• Persistent Foothold: Attackers can install backdoors on the device to maintain long-term access.

Cyber Observables — Hunting Hints

Security teams should monitor for signs of scanning and exploitation in their web server logs.

Detection Methods

• Log Analysis: Scrutinize web access logs for the LoadMaster appliance for any requests to the /accessv2 endpoint from untrusted sources. The presence of such requests should be treated as a potential compromise attempt.
• Vulnerability Scanning: Run internal and external vulnerability scans to identify all Kemp LoadMaster appliances and verify if they are running a vulnerable version.
• Network Intrusion Detection System (NIDS): Deploy NIDS signatures that can detect the specific exploit pattern for CVE-2026-8037.

Remediation Steps

1. Patch Immediately: The top priority is to upgrade all vulnerable Kemp LoadMaster appliances to a patched version (GA v7.2.63.2 or LTSF v7.2.54.18 or later).
2. Restrict API Access: If patching is not immediately possible, restrict access to the LoadMaster's management and API interfaces to a limited set of trusted internal IP addresses. Do not expose the management interface to the internet.
3. Disable API: If the API is not being used, consider disabling it entirely as a temporary mitigation.
4. Hunt for Compromise: After patching, review logs for any evidence of exploitation that may have occurred before the patch was applied. A root-level compromise should be assumed if evidence is found, and a full incident response should be initiated.