CISA has directed federal agencies to immediately patch a critical vulnerability in Progress Kemp LoadMaster after confirming active exploitation. The flaw, tracked as CVE-2026-8037 with a CVSS score of 9.6, is an OS command injection that can be triggered without authentication to achieve remote code execution.
According to Progress’ advisory, the vulnerability stems from unsanitized API inputs, specifically in how the appliance handles the apiuser parameter passed to the accessv2 endpoint. A ZDI advisory notes the underlying issue is a lack of proper memory initialization, allowing an attacker to execute code in the context of root. The flaw was disclosed on June 4 alongside a related vulnerability, CVE-2026-33691, and also affects ECS Connection Manager, Connection Manager for ObjectScale, and MOVEit WAF.
How the Exploit Works
Attack surface management firm watchTowr published technical details and proof-of-concept code on June 29, which appears to have kicked off in-the-wild exploitation. The company’s analysis found that the escape_quotes() function in LoadMaster GA version 7.2.63.1 and older, and LoadMaster LTSF version 7.2.54.17 and older, fails to properly handle user-supplied input.
The function allocates an uninitialized heap buffer using malloc() but does not write a null terminator after escaped output, resulting in out-of-bounds reads from adjacent freed memory. watchTowr demonstrated that an unauthenticated attacker could spray command injection payloads into that adjacent memory region, ultimately achieving command execution through the system() function.
Active Exploitation and Federal Deadline
Cybersecurity firm eSentire reported on June 30 that attackers began attempting to exploit CVE-2026-8037 almost immediately after watchTowr’s technical writeup went public, though the firm noted early attempts were unsuccessful.
eSentire warned that because LoadMaster appliances typically sit at the network edge with visibility into critical internal services, a successful compromise could give attackers an initial foothold for broader malicious activity inside affected environments.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on Friday, giving federal civilian agencies just three days to apply patches under Binding Operational Directive requirements. Organizations running affected LoadMaster or related Progress products should treat patching as urgent, given the unauthenticated, root-level RCE potential and confirmed exploitation attempts.