The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical command-injection vulnerability affecting Progress Kemp LoadMaster appliances to its Known Exploited Vulnerabilities (KEV) Catalog, warning that the flaw is being actively exploited in the wild.
Tracked as CVE-2026-8037, the vulnerability allows an unauthenticated remote attacker to execute arbitrary operating system commands on affected LoadMaster appliances.
Progress LoadMaster is an application delivery controller and load balancer commonly deployed at the network edge to distribute application traffic, provide SSL offloading, and manage availability.
Progress Kemp LoadMaster RCE Flaw Exploited
Its location and access to backend infrastructure make a compromise particularly consequential: attackers could potentially use a breached appliance as an entry point for reconnaissance, credential theft, lateral movement, or persistence.
CVE-2026-8037 is classified as CWE-77, or improper neutralization of special elements used in an operating-system command. The flaw exists across multiple LoadMaster API endpoints that process unsanitized, attacker-controlled input.
By submitting specially crafted requests, an attacker may inject shell commands and have them executed by the underlying appliance without needing valid credentials.
The vulnerability has been described as a pre-authentication remote code execution issue, meaning internet-exposed instances are at the highest risk.
Technical analysis has linked the weakness to improper handling of user-supplied input in the LoadMaster application’s escape_quotes() function, which can result in command injection under certain conditions.
CISA’s KEV inclusion confirms exploitation activity, elevating the issue beyond a theoretical exposure. Third-party telemetry cited in reporting identified 792 exploitation attempts originating from 65 unique IP addresses across 41 days.
CISA added the issue to the KEV catalog on August 7, 2026, and set an expedited remediation deadline of August 10 for U.S. federal civilian executive branch agencies.
CISA instructs affected organizations to apply vendor-provided mitigations in line with Binding Operational Directive 26-04, which prioritizes remediation based on risk.
Agencies and enterprises should first identify all LoadMaster appliances, with particular attention to management and API interfaces reachable from the public internet.
Progress LoadMaster administrators should immediately upgrade to supported fixed firmware releases specified in Progress’ security advisory.
Organizations unable to patch immediately should restrict access to the appliance’s administrative interface and API endpoints to trusted management networks, ideally through a VPN, jump host, or tightly scoped firewall rules.
Disabling unnecessary API functionality can also reduce the attack surface while emergency changes are planned. However, network controls should be viewed only as a temporary compensating measure, not a replacement for remediation.
Organizations should treat any confirmed exploitation as a potential full appliance compromise. Incident responders should isolate affected systems, preserve forensic evidence, rotate administrator and API credentials, review connected backend systems.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
 has added a critical command-injection vulnerability affecting Progress Kemp LoadMaster appliances to its Known Exploited Vulnerabilities (KEV) Catalog, warning that the flaw is being actively exploited in the wild.){kind=link}