---
title: "Progress LoadMaster CVE-2026-8037: Exploited Pre-Auth RCE"
url: https://erroneo.us/security/briefs/progress-loadmaster-cve-2026-8037-pre-auth-rce/
description: "Unauthenticated root command injection in the LoadMaster API, public PoC, in CISA KEV. Fixed in GA 7.2.63.2 and LTSF 7.2.54.18. Patch now if the API is on."
type: security-brief
section: "Security Digest"
date_published: 2026-06-04
date_modified: 2026-08-07
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-8037"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Progress LoadMaster CVE-2026-8037: Exploited Pre-Auth RCE

**Verdict: Check exposure.** Only LoadMaster-based appliances with the API enabled are exposed, but for those this is unauthenticated root RCE with a public exploit; if that's you and you're below 7.2.63.2 or 7.2.54.18, patch today.

- **Who must act:** Owners of Progress Kemp LoadMaster (GA 7.2.63.1 or older, LTSF 7.2.54.17 or older) or the ECS/Object Scale Connection Manager and MOVEit WAF builds based on it, with the API enabled.
- **Who can relax:** Appliances already on GA 7.2.63.2 or LTSF 7.2.54.18 or later, deployments with the API disabled, and teams that don't run LoadMaster.
- **Affected:** LoadMaster GA 7.2.63.1 and older, with the API enabled; LoadMaster LTSF 7.2.54.17 and older, with the API enabled; ECS Connection Manager, Object Scale Connection Manager and MOVEit WAF 7.2.60.0 before 7.2.63.2 (per the CVE record)
- **Fixed:** LoadMaster GA 7.2.63.2; LoadMaster LTSF 7.2.54.18; ECS Connection Manager, Object Scale Connection Manager and MOVEit WAF 7.2.63.2
- **CVEs:** CVE-2026-8037
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every LoadMaster and LoadMaster-based appliance, its firmware version, and whether its API is enabled.
2. Upgrade to GA 7.2.63.2 or LTSF 7.2.54.18 (or later).
3. If an upgrade must wait, turn the API off if you don't use it, or restrict who can reach it to admin hosts.
4. Block and search for the source IPs eSentire tied to exploitation attempts: 192.42.116.58, 192.42.116.105, 146.70.139.154.
5. If the API was reachable while unpatched, rotate LoadMaster admin and API credentials and review the appliance for changes.

### How to check if you are affected

- Search reverse-proxy, firewall or appliance logs for POST requests to /accessv2 with unusually large JSON bodies (many extra keys) from unexpected sources.
- Look for connections from 192.42.116.58, 192.42.116.105 and 146.70.139.154.
- On appliances whose API was reachable while vulnerable, check for unknown users, configuration changes, new files or processes, and unexpected outbound connections; engage Progress support if anything is off.

## What happened

On June 4, 2026, Progress published a [critical bulletin](https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691) for its Kemp LoadMaster application delivery controller. Its CVE-2026-8037 is an OS command injection in the LoadMaster API. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-8037) says it lets "an un-authenticated attacker" run arbitrary commands "by exploiting unsanitized input in multiple command endpoints." Progress scores it CVSS 3.1 9.6 with an adjacent-network vector. [ZDI](https://www.zerodayinitiative.com/advisories/ZDI-26-342/), which coordinated the report from Syed Ibrahim Ahmed of TrendAI Research, scores it 9.8 and says code runs "in the context of root." The same bulletin covers CVE-2026-33691, a whitespace-padding file-upload bypass in the OWASP Core Rule Set used by the WAF. That one is not exploited and is not in KEV.

On June 29, [watchTowr Labs](https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/) published a patch-diff analysis and a working proof of concept. The bug is in `escape_quotes()`, which sanitizes the `apiuser` and `apipass` values sent to `/accessv2` before they reach a shell command. It allocated its output buffer with `malloc()` and never null-terminated it, so heap grooming through extra JSON keys can smuggle attacker data into the command. The fix switches to `calloc()` and adds the terminator. [eSentire](https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037) saw exploitation attempts the same day; in its cases they failed, with no post-compromise activity. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037) on August 7.

## Who is affected

LoadMaster GA 7.2.63.1 and older and LTSF 7.2.54.17 and older are affected when the API is enabled, per watchTowr, eSentire and the [Canadian Centre for Cyber Security](https://www.cyber.gc.ca/en/alerts-advisories/progress-security-advisory-av26-552). The fixed releases are GA 7.2.63.2 and LTSF 7.2.54.18. The CVE record also lists ECS Connection Manager, Object Scale Connection Manager and MOVEit WAF from 7.2.60.0 up to, but not including, 7.2.63.2. Those products run on the LoadMaster platform.

## Do you really need to act?

The urgency depends on one setting. If the API is disabled, the documented attack path is not there and you can patch on a normal cycle. If the API is enabled, anyone who can reach it can try a public, root-level exploit with no credentials. Progress's adjacent-network scoring assumes the API sits on an internal segment. If yours is reachable from wider networks or the internet, treat it as remote.

Exploitation so far looks noisy rather than devastating. eSentire's observed attempts failed. [The Hacker News](https://thehackernews.com/2026/08/progress-kemp-loadmaster-flaw-hits-cisa.html) cites KEVIntel telemetry of 792 attempts from 65 IPs over 41 days. CISA's listing still means someone succeeded or came close enough. Load balancers sit in front of critical services and often terminate TLS, so a compromise reaches far. This is the second LoadMaster command injection in KEV, after CVE-2024-1212, according to [The Hacker News](https://thehackernews.com/2026/06/progress-kemp-loadmaster-flaw-could-let.html).

## What to do now

1. List every LoadMaster and LoadMaster-based appliance, with its firmware version and whether the API is enabled.
2. Upgrade to GA 7.2.63.2 or LTSF 7.2.54.18 or later, starting with any appliance whose API is reachable beyond an admin network.
3. If you must wait, disable the API where nothing depends on it, or firewall it down to automation and admin hosts.
4. Block `192.42.116.58`, `192.42.116.105` and `146.70.139.154`, the sources eSentire saw, and search your logs for them.
5. If the API was reachable while unpatched, rotate admin and API credentials, plus TLS private keys held on the appliance if you find any sign of compromise.

## How to tell if you were hit

The public write-ups give little to detect on. watchTowr publishes no log signatures, and Progress has not published IOCs as of October 21, 2026. The exploit is a JSON `POST` to `/accessv2` padded with many extra key/value pairs. Look for such requests from unexpected sources in any proxy, firewall or appliance logs you keep, along with the three eSentire IPs. On appliances that were exposed, look for configuration changes you didn't make, new accounts, unfamiliar files or processes, and outbound connections from the appliance. Engage Progress support if anything looks off.

## Timeline

- Apr 15, 2026 — The flaw is reported to Progress through ZDI.
- Jun 4, 2026 — Progress publishes the bulletin and fixed builds.
- Jun 9, 2026 — ZDI publishes ZDI-26-342.
- Jun 29, 2026 — watchTowr publishes its analysis and PoC. eSentire sees the first, unsuccessful exploitation attempts.
- Aug 7, 2026 — CISA adds CVE-2026-8037 to KEV (federal deadline Aug 10).

## Sources

1. [Progress — LoadMaster Critical Security Bulletin June 2026 (CVE-2026-8037, CVE-2026-33691)](https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691)
2. [CVE record — CVE-2026-8037](https://www.cve.org/CVERecord?id=CVE-2026-8037)
3. [CISA — Known Exploited Vulnerabilities: CVE-2026-8037](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037)
4. [Zero Day Initiative — ZDI-26-342: Kemp LoadMaster apiuser Uninitialized Memory RCE](https://www.zerodayinitiative.com/advisories/ZDI-26-342/)
5. [watchTowr Labs — Progress Kemp LoadMaster: uninitialized heap to pre-auth RCE (CVE-2026-8037)](https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/)
6. [eSentire — Progress Kemp LoadMaster vulnerability targeted (CVE-2026-8037)](https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037)
7. [Canadian Centre for Cyber Security — Progress security advisory (AV26-552)](https://www.cyber.gc.ca/en/alerts-advisories/progress-security-advisory-av26-552)
8. [The Hacker News — Progress Kemp LoadMaster flaw could let attackers run commands as root](https://thehackernews.com/2026/06/progress-kemp-loadmaster-flaw-could-let.html)
9. [The Hacker News — Progress Kemp LoadMaster flaw hits CISA KEV](https://thehackernews.com/2026/08/progress-kemp-loadmaster-flaw-hits-cisa.html)

---
Source page: https://erroneo.us/security/briefs/progress-loadmaster-cve-2026-8037-pre-auth-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt