CVE-2026-8037 lets anyone run root commands on Kemp LoadMaster appliances with zero credentials — and 792 attack attempts from 65 IP addresses landed before it made the federal watch list.
Progress patched a critical bug in its Kemp LoadMaster load balancer on June 4. Nobody touched it for 25 days. Then, on June 29, a full technical writeup with working proof-of-concept code went public — and attackers started hitting it the same day. By the time CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalog on August 7, telemetry firm KEVIntel had already counted 792 exploitation attempts from 65 unique IP addresses spread across 18 countries. The bug lets an attacker with zero credentials run arbitrary commands as root on any exposed LoadMaster appliance with its API enabled.
The bug: a sanitization function that forgot to finish the job
The flaw lives inside LoadMaster's /accessv2 API endpoint, in a function called escape_quotes() whose entire job is to make user input safe before it's handed to a shell command. Researchers at watchtowr Labs found that the function allocates a heap buffer for the escaped string but never properly null-terminates it — an oversight that lets an out-of-bounds read leak attacker-controlled bytes straight into a system() call. No login required, no user interaction, just a request to an internet-facing management API. watchtowr's technical breakdown walks through the exact memory layout that makes it work, and it's the kind of bug that reads obvious in hindsight — which is exactly why it's dangerous now that the technique is public.
9.8
CVSS score
Zero Day Initiative rating
792
Exploit attempts logged
KEVIntel telemetry, late June–Aug 4
65
Source IPs
Across 18 countries
25 days
Patch-to-exploit gap
Fix shipped June 4; attacks began June 29
Why the gap between 'patched' and 'CISA cares' matters
This is the part that should bother IT teams more than the bug itself. Progress did everything right on paper — patched before anyone was attacking, published fixed versions, gave customers weeks of runway. And it still took a public proof-of-concept for exploitation to start, and another five-plus weeks after that for CISA's Known Exploited Vulnerabilities catalog — the list a huge number of organizations use as their actual patch-priority signal — to flag it. eSentire had already reported active targeting in July, a month before the federal deadline landed. If your patch cadence is 'wait for the KEV catalog,' you were exposed for a month longer than you needed to be. The Hacker News has the full attempt-count breakdown.
Kemp LoadMaster appliances sit in front of production traffic — exactly the kind of internet-facing box this bug targets. · Unsplash
Fixing it
Check whether your LoadMaster's API is enabled — that's the precondition for exposure via /accessv2.
2
Upgrade to GA 7.2.63.2 or LTSF 7.2.54.18, the fixed releases Progress shipped on June 4.
3
If you can't patch immediately, disable the LoadMaster API or restrict it to trusted management networks only.
4
Review logs for requests to /accessv2 from unfamiliar IPs going back to late June — that's your exposure window.
LoadMaster joins a run of network-appliance bugs this year that follow the same shape — pre-auth, root-level, and exploited within weeks of going public. It sits alongside the SAML flaw in Citrix's NetScaler, the unauthenticated takeover in N-able's N-central, the mailbox-exposing bug demoed live at Pwn2Own against Exchange Server, and an unauthenticated GeoServer SQL injection — all management-plane software that's supposed to be trusted infrastructure, all handing over root to anyone who asks correctly.
Do I need the LoadMaster API enabled for this to affect me?
Yes — CVE-2026-8037 is reachable through the /accessv2 endpoint, which requires the LoadMaster API to be turned on. If it's off, this specific path is closed.
Is this the same bug eSentire reported in July?
Yes, same CVE. eSentire flagged early targeting in July; CISA's KEV listing on August 7 formalized what was already happening.
What happens if an attacker exploits this?
Arbitrary command execution as root on the appliance — full control, no credentials needed.
Are older LoadMaster versions also vulnerable?
Any GA release at or before 7.2.63.1, or LTSF at or before 7.2.54.17, is vulnerable. Anything on or after the fixed builds is safe.
Progress moved fast on the fix. The five weeks between a public proof-of-concept and a federal deadline is where this one actually went wrong, and it's a gap that exists for almost every CVE that eventually lands on the KEV list — the catalog is a lagging indicator, not a warning system. If a management appliance you run just got a critical pre-auth patch, that's the alarm. Don't wait for CISA to ring it again.
