Full research report

Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

CVE-2026-8037 follows a pattern increasingly observed in edge network appliances: a low-complexity implementation defect in a string-handling function produces an unauthenticated root-level exploit accessible without credentials. The watchTowr Labs write-up, published the same day exploitation activity was first recorded (29 June 2026), functioned as the operational trigger — telemetry confirms exploitation attempts commenced concurrently with its release, illustrating how rapidly detailed public research translates to attack activity against internet-facing appliances. With 792 attempts from 65 IPs across 18 countries by 4 August 2026, the campaign reflects broad opportunistic scanning rather than targeted intrusion at this stage, though confirmed post-compromise success remains publicly unverified. The NVD record expands the affected surface to include MOVEit WAF and connection managers alongside LoadMaster, a breadth that may not be fully inventoried by all affected organisations. This is also the second critical Progress Kemp LoadMaster vulnerability added to the CISA KEV catalogue within two years, suggesting systemic concerns in the product's API authentication implementation that warrant broader scrutiny of the product family.

What happened

Progress Software disclosed CVE-2026-8037, a critical unauthenticated OS command injection flaw in Kemp LoadMaster appliances, on 4 June 2026 alongside patches. On 29 June 2026, watchTowr Labs published a detailed technical write-up that included a working exploit demonstration, triggering exploitation attempts that same day. eSentire confirmed exploitation activity from late June through July 2026, with attempts described as largely unsuccessful. CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 7 August 2026, mandating Federal Civilian Executive Branch agencies patch by 10 August 2026.

Affected scope

Progress Kemp LoadMaster GA releases up to and including 7.2.63.1 and LTSF releases up to and including 7.2.54.17, where the API feature is enabled. The NVD entry additionally lists ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF as affected products. The flaw is exposed on internet-facing load balancer appliances across enterprise, government, and service-provider environments globally.

Technical assessment

The vulnerability resides in the escape_quotes() function within LoadMaster's API authentication layer. The function allocates an uninitialized heap buffer via malloc() and does not null-terminate the output string after escaping single-quote characters, producing an out-of-bounds read into adjacent heap memory. When specially crafted input is submitted to the API endpoint, attacker-influenced data present in freed heap chunks can be injected into a shell command that is subsequently executed, enabling unauthenticated root-level command execution. The vendor fix replaces malloc() with calloc() to zero-fill allocated memory and adds explicit null termination. The reachable endpoint requires the API feature to be enabled, which is not the default configuration on all deployments.

Recommended defensive actions

  1. Patch immediately to LoadMaster GA 7.2.63.2 or LTSF 7.2.54.18; FCEB agencies must comply by 10 August 2026 per Binding Operational Directive 26-04.
  2. Disable the LoadMaster API feature on any appliance where it is not operationally required, eliminating the exposed attack surface entirely.
  3. Restrict network access to the management interface and the /accessv2 API endpoint to trusted, internal IP ranges using firewall or access-control rules.
  4. Block or alert on traffic from confirmed attacker IPs 192.42.116.58, 192.42.116.105, and 146.70.139.154 as an immediate tactical measure, noting these may represent anonymising infrastructure and not sole sources.
  5. Hunt for anomalous root-level process execution or unexpected outbound connections originating from LoadMaster appliances, covering the window from 29 June 2026 onwards.

Uncertainties and evidence gaps

  • Whether any exploitation attempt has produced confirmed post-compromise activity: eSentire reported no post-compromise activity in its early July 2026 observation window, but CISA's KEV addition implies exploitation evidence exists; the gap between these assessments is not publicly explained.
  • Attribution of the threat actors behind the 65 observed attacker IPs is unknown; the 192.42.116.x range is associated with anonymising infrastructure, precluding reliable actor identification.
  • The full scope of affected Progress product lines beyond LoadMaster — specifically ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF — has limited independent reporting and may not be fully inventoried by all affected organisations.
  • A minor date discrepancy exists between sources regarding the KEV addition: the source material and CCCS advisory indicate 7 August 2026, while Security Affairs notes 5 August; the difference does not materially affect the assessment but the authoritative CISA record could not be fetched directly.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnauthenticated network access to the LoadMaster API endpoint (/accessv2); no credentials or prior authentication required
ComponentLoadMaster API authentication handler — escape_quotes() string-processing function in the ADC application layer
MechanismUninitialized heap buffer allocation without null termination creates an out-of-bounds read condition into adjacent heap memory containing attacker-influenced data, enabling injection into a shell execution call
ImpactUnauthenticated remote code execution as root on the appliance, resulting in full device compromise and potential access to managed network segments
DetectionAnomalous API requests to /accessv2 containing crafted single-quote sequences; unexpected root-level process spawning on the appliance; outbound connections from the appliance to unknown external hosts
MitigationUpgrade to LoadMaster GA 7.2.63.2 or LTSF 7.2.54.18; alternatively disable the API feature entirely or restrict API access to trusted source IPs via firewall policy
Exploitation status

Confirmed active exploitation in the wild; CISA added CVE-2026-8037 to the Known Exploited Vulnerabilities catalogue on 7 August 2026. Telemetry recorded 792 exploitation attempts from 65 unique IP addresses across 18 countries over the preceding 41 days. Early attempts observed by eSentire in late June and July 2026 were reportedly unsuccessful, with no post-compromise activity detected at that point.

Research process

Investigation began from CISA KEV confirmation and article-reported telemetry of 792 exploitation attempts. Research prioritised the original vulnerability analysis, first-party exploitation telemetry, and independent government-level corroboration. The watchTowr Labs write-up and eSentire advisory provided technical and telemetry evidence respectively; the Canadian CCCS advisory and NVD entry supplied two independent government-domain sources. The evidence cohesively establishes confirmed active exploitation, a precise disclosure-to-weaponisation timeline of 25 days, and unambiguous patch targets, supporting a high-confidence assessment.

  1. What is CVE-2026-8037, who reported it, and what are the key technical and timeline facts?
    Searched for 'CVE-2026-8037 Progress Kemp LoadMaster command injection 2026'

    CVE-2026-8037 is a CVSS 9.6 unauthenticated OS command injection in LoadMaster's escape_quotes() API function; disclosed 4 June 2026; watchTowr Labs published a technical write-up with PoC on 29 June 2026; exploitation began that same day; patches are GA 7.2.63.2 and LTSF 7.2.54.18.

    why Established the core event, timeline, and primary research sources before fetching individual URLs.

  2. Can the CISA KEV catalogue entry be fetched directly to confirm the addition and patch deadline?
    Attempted to fetch the CISA KEV catalogue page
    cisa.gov ↗

    Page returned HTTP 403 Forbidden; KEV entry details could not be confirmed from primary source directly.

    why KEV addition is instead corroborated via the successfully fetched CCCS advisory and Security Affairs article; no gap in the assessment results.

  3. What does the watchTowr Labs write-up establish about the vulnerability mechanism and public PoC availability?
    Fetched the watchTowr Labs research article
    labs.watchtowr.com ↗

    Published 29 June 2026; confirms the malloc()/null-termination defect in escape_quotes(); describes the heap-based exploit chain non-weaponisably; includes a complete HTTP request demonstrating unauthenticated RCE; documents affected versions and patches.

    why This is the primary technical source and the publication whose release is co-incident with the exploitation onset — the key operational link.

  4. What exploitation activity and indicators of compromise has eSentire documented from its own telemetry?
    Fetched the eSentire security advisory
    esentire.com ↗

    eSentire TRU identified exploitation attempts from 29 June 2026 targeting /accessv2; three specific attacker IPs recorded (192.42.116.58, 192.42.116.105, 146.70.139.154); no post-compromise activity detected in the initial observation window.

    why First-party telemetry provides specific IOCs and the critical caveat that attempts were unsuccessful at that stage, which must be weighed against the later CISA KEV addition.

  5. What does the NVD record confirm about classification, CVSS scoring, and affected product scope?
    Fetched the NVD entry for CVE-2026-8037
    nvd.nist.gov ↗

    NVD assigns CVSS 9.8 versus the CNA's 9.6; CWE-77 (Command Injection); FCEB due date 10 August 2026 confirmed; additionally lists ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF as affected products.

    why NVD provides authoritative CWE classification, expands the affected product scope beyond the headline product, and independently confirms the KEV due date.

  6. Is there an independent government advisory corroborating the KEV addition and patch guidance?
    Fetched the Canadian Centre for Cyber Security advisory AV26-552
    cyber.gc.ca ↗

    CCCS updated advisory AV26-552 on 7 August 2026; lists CVE-2026-8037 as actively exploited among seven Progress CVEs; corroborates affected versions and patch urgency.

    why An independent Five Eyes partner government advisory fulfils the requirement for a second independent domain corroborating exploitation status and the 7 August KEV date.

  7. Does Security Affairs independently corroborate the CISA KEV addition and add any further context?
    Fetched the Security Affairs article on the CISA KEV addition
    securityaffairs.com ↗

    Confirms CISA KEV addition (notes 5 August, a minor discrepancy versus the 7 August in source material and CCCS); confirms exploitation timeline from 29 June; reproduces the eSentire 'unsuccessful attempts' caveat.

    why Third independent domain corroborating the event; the one-day date discrepancy is noted as an uncertainty but does not affect the substance of the assessment.

  8. What additional exploitation context does the July 2026 reporting window provide, and is there a historical pattern?
    Fetched The Hacker News article from July 2026 on active exploitation attempts
    thehackernews.com ↗

    Confirms exploitation commenced 29 June concurrent with PoC release; attacker IPs consistent across reports; notes this is the second critical LoadMaster flaw under active exploitation following CVE-2024-1212 (CVSS 10.0), indicating a pattern of targeting this product line.

    why Establishes historical context for repeated LoadMaster exploitation and confirms IOC consistency across multiple independent reporting sources.

Named in this story
ActorsUnattributed threat actors operating from anonymising infrastructure (IPs: 192.42.116.58, 192.42.116.105, 146.70.139.154)
TargetsProgress Kemp LoadMaster operatorsFederal Civilian Executive Branch agenciesEnterprise and service-provider network infrastructure
Related CVEs CVE-2026-8037

Research coverage

All 68 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (3 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 55 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
CISA KEVkev ok1662 records Primary evidence1 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue.
NVDcve ok900 records Primary evidence1 matched items Supplied a vendor or government advisory opened and verified during focused research.
The Hacker Newsnews ok5 records Primary evidence1 matched items Published the source report used to frame and date the event.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
FIRST EPSSepss ok Context1 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
BleepingComputernews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory stale fallback0 records Failed The current collection attempt failed; this source cannot support the report.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok677 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1008 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok7 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1589 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok7 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 7 opened outside the registered collection
References & evidence
Vulnerability & exploitation2
CVE-2026-8037 CISA KEV Progress LoadMaster · added 2026-08-07 CISA catalog ↗
CVE-2026-8037 EPSS 84.8% 100th percentile exploitation probability
PoC & exploit code1
Enterprise Tech In, Shell Out — watchTowr Labs CVE-2026-8037 technical write-up labs.watchtowr.com ↗

Primary public technical analysis published 29 June 2026; includes a complete HTTP request demonstrating unauthenticated RCE — the same day exploitation attempts began.

Vendor & gov advisories3
NVD — CVE-2026-8037 nvd.nist.gov ↗

NIST NVD entry; CVSS 9.8 (NIST) versus 9.6 (CNA); CWE-77; lists additional affected Progress products beyond LoadMaster; FCEB due date 10 August 2026.

Canadian Centre for Cyber Security — Progress Security Advisory AV26-552 cyber.gc.ca ↗

Canadian government advisory updated 7 August 2026; lists CVE-2026-8037 as actively exploited among seven Progress CVEs and corroborates patch urgency.

eSentire Security Advisory — Progress Kemp LoadMaster Vulnerability Targeted (CVE-2026-8037) esentire.com ↗

First-party telemetry advisory; documents exploitation attempts from 29 June 2026, attacker IP addresses, and confirms no post-compromise activity in the initial observation window.

Analysis & research2
Security Affairs — U.S. CISA adds Progress LoadMaster flaw to Known Exploited Vulnerabilities catalog securityaffairs.com ↗

Independent corroboration of CISA KEV addition, exploitation timeline, and the eSentire 'unsuccessful attempts' caveat.

The Hacker News — Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts (July 2026) thehackernews.com ↗

Corroborates eSentire IOCs and notes historical parallel with CVE-2024-1212, establishing a pattern of LoadMaster targeting.