Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts

A critical pre-authentication remote code execution vulnerability in Progress Kemp LoadMaster has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog after threat researchers documented 792 exploitation attempts in the wild — despite the patch being available since early June.

The Vulnerability: CVE-2026-8037

Tracked as CVE-2026-8037 with a CVSS score of 9.6 Critical, the flaw resides in the escape_quotes() string sanitisation function within LoadMaster's API handler. The root cause is deceptively subtle: the function allocates an uninitialised heap buffer via malloc without null-terminating it. If a previously-freed adjacent heap chunk contains unescaped payload bytes with no null terminator, the __sprintf_chk() call walks out of bounds into that stale chunk — creating a heap memory leak that can be leveraged for unauthenticated command injection and root-level RCE.

The vulnerable surface is the /accessv2 API endpoint, which must be enabled for the attack to succeed. No authentication or prior access is required.

The Fix

Progress addressed the bug through two targeted changes in the June 4, 2026 patch:

1. Replacing malloc with calloc(1u, …) — zero-filling the buffer on allocation, eliminating residual bytes in adjacent freed chunks
2. Adding an explicit *end = 0 null terminator after the escape loop

Both changes close the path from uninitialized memory to command injection.

Active Exploitation Timeline

The vulnerability moved from patch to active exploitation in under four weeks:

• June 4, 2026: Progress quietly released patches in LoadMaster GA 7.2.63.2 and LTSF 7.2.54.18
• June 29, 2026: watchTowr Labs published a full technical write-up and public proof-of-concept — exploitation activity began the same day
• 41 days of active scanning: eSentire's Threat Response Unit (TRU) observed 792 exploit attempts originating from 65 distinct IP addresses, primarily 192.42.116.58, 192.42.116.105, and 146.70.139.154
• August 2026: CISA added CVE-2026-8037 to the KEV catalog under Binding Operational Directive 26-04

Notably, all observed exploitation attempts were unsuccessful — no post-compromise activity was detected across monitored environments. However, the volume and persistence of attempts underscores the risk for unpatched deployments.

A Recurring Pattern

This is not LoadMaster's first critical pre-auth RCE. CVE-2024-1212 (CVSS 10.0) followed the same architectural pattern — unauthenticated command injection via the API of an edge-deployed load balancer. The recurrence of this vulnerability class in LoadMaster suggests a systemic issue with input handling in the product's API layer rather than an isolated oversight.

Edge load balancers are particularly high-value targets: they sit at the network perimeter, handle all inbound traffic, and are frequently internet-facing with minimal intermediary controls.

Remediation

Organizations running Progress Kemp LoadMaster should take immediate action:

• Patch to GA 7.2.63.2 or LTSF 7.2.54.18 — the only fully effective remediation
• If immediate patching is not possible, disable the LoadMaster API to eliminate the attack surface
• Federal agencies must comply with BOD 26-04 guidance and apply the patch by the CISA-mandated deadline

The combination of a public PoC, CISA KEV listing, and documented active exploitation makes this a high-priority patching event for any organization with internet-exposed LoadMaster appliances.