Progress LoadMaster CVE-2026-8037: Exploited Pre-Auth RCE

What to do

1. Inventory every LoadMaster and LoadMaster-based appliance, its firmware version, and whether its API is enabled.
2. Upgrade to GA 7.2.63.2 or LTSF 7.2.54.18 (or later).
3. If an upgrade must wait, turn the API off if you don't use it, or restrict who can reach it to admin hosts.
4. Block and search for the source IPs eSentire tied to exploitation attempts: 192.42.116.58, 192.42.116.105, 146.70.139.154.
5. If the API was reachable while unpatched, rotate LoadMaster admin and API credentials and review the appliance for changes.

How to check if you are affected or compromised

• Search reverse-proxy, firewall or appliance logs for POST requests to /accessv2 with unusually large JSON bodies (many extra keys) from unexpected sources.
• Look for connections from 192.42.116.58, 192.42.116.105 and 146.70.139.154.
• On appliances whose API was reachable while vulnerable, check for unknown users, configuration changes, new files or processes, and unexpected outbound connections; engage Progress support if anything is off.

What happened#

On June 4, 2026, Progress published a critical bulletin for its Kemp LoadMaster application delivery controller. Its CVE-2026-8037 is an OS command injection in the LoadMaster API. The CVE record says it lets "an un-authenticated attacker" run arbitrary commands "by exploiting unsanitized input in multiple command endpoints." Progress scores it CVSS 3.1 9.6 with an adjacent-network vector. ZDI, which coordinated the report from Syed Ibrahim Ahmed of TrendAI Research, scores it 9.8 and says code runs "in the context of root." The same bulletin covers CVE-2026-33691, a whitespace-padding file-upload bypass in the OWASP Core Rule Set used by the WAF. That one is not exploited and is not in KEV.

On June 29, watchTowr Labs published a patch-diff analysis and a working proof of concept. The bug is in escape_quotes(), which sanitizes the apiuser and apipass values sent to /accessv2 before they reach a shell command. It allocated its output buffer with malloc() and never null-terminated it, so heap grooming through extra JSON keys can smuggle attacker data into the command. The fix switches to calloc() and adds the terminator. eSentire saw exploitation attempts the same day; in its cases they failed, with no post-compromise activity. CISA added the CVE to the KEV catalog on August 7.

Who is affected#

LoadMaster GA 7.2.63.1 and older and LTSF 7.2.54.17 and older are affected when the API is enabled, per watchTowr, eSentire and the Canadian Centre for Cyber Security. The fixed releases are GA 7.2.63.2 and LTSF 7.2.54.18. The CVE record also lists ECS Connection Manager, Object Scale Connection Manager and MOVEit WAF from 7.2.60.0 up to, but not including, 7.2.63.2. Those products run on the LoadMaster platform.

Do you really need to act?#

The urgency depends on one setting. If the API is disabled, the documented attack path is not there and you can patch on a normal cycle. If the API is enabled, anyone who can reach it can try a public, root-level exploit with no credentials. Progress's adjacent-network scoring assumes the API sits on an internal segment. If yours is reachable from wider networks or the internet, treat it as remote.

Exploitation so far looks noisy rather than devastating. eSentire's observed attempts failed. The Hacker News cites KEVIntel telemetry of 792 attempts from 65 IPs over 41 days. CISA's listing still means someone succeeded or came close enough. Load balancers sit in front of critical services and often terminate TLS, so a compromise reaches far. This is the second LoadMaster command injection in KEV, after CVE-2024-1212, according to The Hacker News.

What to do now#

1. List every LoadMaster and LoadMaster-based appliance, with its firmware version and whether the API is enabled.
2. Upgrade to GA 7.2.63.2 or LTSF 7.2.54.18 or later, starting with any appliance whose API is reachable beyond an admin network.
3. If you must wait, disable the API where nothing depends on it, or firewall it down to automation and admin hosts.
4. Block 192.42.116.58, 192.42.116.105 and 146.70.139.154, the sources eSentire saw, and search your logs for them.
5. If the API was reachable while unpatched, rotate admin and API credentials, plus TLS private keys held on the appliance if you find any sign of compromise.

How to tell if you were hit#

The public write-ups give little to detect on. watchTowr publishes no log signatures, and Progress has not published IOCs as of October 21, 2026. The exploit is a JSON POST to /accessv2 padded with many extra key/value pairs. Look for such requests from unexpected sources in any proxy, firewall or appliance logs you keep, along with the three eSentire IPs. On appliances that were exposed, look for configuration changes you didn't make, new accounts, unfamiliar files or processes, and outbound connections from the appliance. Engage Progress support if anything looks off.

Timeline#

• Apr 15, 2026 — The flaw is reported to Progress through ZDI.
• Jun 4, 2026 — Progress publishes the bulletin and fixed builds.
• Jun 9, 2026 — ZDI publishes ZDI-26-342.
• Jun 29, 2026 — watchTowr publishes its analysis and PoC. eSentire sees the first, unsuccessful exploitation attempts.
• Aug 7, 2026 — CISA adds CVE-2026-8037 to KEV (federal deadline Aug 10).

Vulnerability records

• CVE-2026-8037 · KEV 2026-08-07 · OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Progress — LoadMaster Critical Security Bulletin June 2026 (CVE-2026-8037, CVE-2026-33691) community.progress.com
2. CVE record — CVE-2026-8037 cve.org
3. CISA — Known Exploited Vulnerabilities: CVE-2026-8037 cisa.gov
4. Zero Day Initiative — ZDI-26-342: Kemp LoadMaster apiuser Uninitialized Memory RCE zerodayinitiative.com
5. watchTowr Labs — Progress Kemp LoadMaster: uninitialized heap to pre-auth RCE (CVE-2026-8037) labs.watchtowr.com
6. eSentire — Progress Kemp LoadMaster vulnerability targeted (CVE-2026-8037) esentire.com
7. Canadian Centre for Cyber Security — Progress security advisory (AV26-552) cyber.gc.ca

Coverage and analysis

1. The Hacker News — Progress Kemp LoadMaster flaw could let attackers run commands as root thehackernews.com
2. The Hacker News — Progress Kemp LoadMaster flaw hits CISA KEV thehackernews.com