The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added a critical security vulnerability affecting Progress Kemp LoadMaster to its Known Exploited Vulnerabilities (KEV) catalog. This decision follows reports of active exploitation of the flaw in real-world scenarios.
Identified as CVE-2026-8037, this command injection vulnerability carries a CVSS score of 9.6, indicating its severe impact. The flaw allows unauthenticated attackers to execute arbitrary commands on vulnerable LoadMaster appliances by exploiting unsanitized input in multiple command endpoints.
In June 2026, watchTowr Labs analyzed the issue, pinpointing the root cause to a function named “escape_quotes()” within the load balancer application. The vulnerability arises from improper handling of user-supplied input, leading to potential command injection. Exploiting this flaw enables attackers to run arbitrary commands on affected appliances without needing valid credentials.
eSentire, a Canadian security firm, reported observing active exploitation attempts targeting this vulnerability. Although many of these efforts were unsuccessful, the persistence of such attempts underscores the critical nature of the flaw. Notably, attacks have been traced back to IP addresses including 192.42.116[.]58, 192.42.116[.]105, and 146.70.139[.]154.
Telemetry data from KEVIntel indicates that over a 41-day period, 792 exploitation attempts were recorded from 65 unique IP addresses across 18 countries, including Australia, China, Indonesia, Japan, Poland, and the United States. The most recent activity was noted on August 4, 2026, with five exploitation attempts detected on that day.
In response to the active exploitation, CISA has mandated that Federal Civilian Executive Branch (FCEB) agencies apply the necessary patches by August 10, 2026, to secure their networks, in line with Binding Operational Directive (BOD) 26-04.
This incident highlights the ongoing challenges in securing network infrastructure devices. Organizations utilizing Progress Kemp LoadMaster should prioritize updating their systems to the latest patched versions to mitigate potential risks. Additionally, implementing robust monitoring and intrusion detection systems can help identify and respond to exploitation attempts promptly.
