This load balancer bug got patched in June. Hackers had a five-week head start before CISA said a word

CVE-2026-8037 is a pre-authentication command injection flaw in Progress's Kemp LoadMaster, rated as high as CVSS 9.8 by Zero Day Initiative.

It lives in a sanitization function called escape_quotes(), which fails to null-terminate escaped strings — letting attacker input break out and run as an OS command.

Progress shipped a fix on June 4 (LoadMaster GA 7.2.63.2 and LTSF 7.2.54.18). Exploitation began June 29, the day public proof-of-concept code appeared.

Security firm KEVIntel logged 792 exploitation attempts from 65 IPs across 18 countries between late June and August 4.

CISA added it to the KEV catalog on August 7 and gave federal agencies until August 10 to patch — a three-day window.

The real lesson here

I'd stop treating 'CISA added it to KEV' as the trigger to patch and start treating 'vendor shipped a fix for something pre-auth and root-level' as the trigger. By the time a bug earns a KEV entry,…