Full research report

Critical Progress LoadMaster flaw now actively exploited in attacks

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

CVE-2026-8037 is a pre-authentication root remote-code-execution vulnerability in Progress Kemp LoadMaster caused by a defective heap-buffer handling routine in the escape_quotes() function that allows unauthenticated attackers to inject arbitrary shell commands through the device's public API. A full proof-of-concept was published by watchTowr Labs on 29 June 2026—more than three weeks after patches were available—triggering immediate exploitation attempts from at least 65 distinct IP addresses across 18 countries, with 792 attempts recorded over 41 days. CISA added the vulnerability to its KEV catalogue on 7 August 2026, mandating a three-day remediation window for U.S. federal agencies under BOD 26-04. Patches (GA 7.2.63.2 and LTSF 7.2.54.18) have been available since June, making continued unpatched exposure indefensible. No threat actor has been attributed and no confirmed post-compromise activity has been reported, but LoadMaster's network-edge position and visibility into internal services make it a high-value initial-access target.

What happened

Progress Software disclosed CVE-2026-8037, a critical unauthenticated OS command injection vulnerability in Kemp LoadMaster, on 4 June 2026 and released patches the same day. On 29 June 2026, watchTowr Labs published a detailed technical write-up with a functional proof-of-concept, and exploitation attempts began immediately. By 7 August 2026, CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue after 792 attempts were recorded from 65 distinct IP addresses across 18 countries over 41 days, and U.S. federal agencies were ordered to patch by 10 August 2026.

Affected scope

Progress Kemp LoadMaster GA v7.2.63.1 and older, LoadMaster LTSF v7.2.54.17 and older, and MOVEit WAF all versions before GA v7.2.63.2; over 100,000 global deployments with approximately 300 instances internet-facing per Shadowserver; customer base includes 80% of Fortune 500 companies, Amazon, and the U.S. Air Force.

Technical assessment

The vulnerability originates in the escape_quotes() function, which allocates a heap buffer via malloc() without initialising it or writing a null terminator after the escaped output. An unauthenticated attacker submits crafted content to the apiuser parameter of the /accessv2 API endpoint; the absent null terminator causes adjacent heap memory to be read during subsequent processing, allowing injected command content to reach and be executed by the system() call as root. No credentials or prior foothold are required beyond API reachability from an untrusted network.

Recommended defensive actions

  1. Patch all LoadMaster instances to GA 7.2.63.2 or LTSF 7.2.54.18 immediately; U.S. federal agencies were required to meet a 10 August 2026 deadline under BOD 26-04.
  2. Restrict network access to the LoadMaster API endpoint to trusted management hosts only, preventing exposure from untrusted networks or the public internet.
  3. Audit internet-facing LoadMaster appliances using Shadowserver or equivalent telemetry to identify unpatched or exposed instances.
  4. Monitor LoadMaster API logs for anomalous requests to /accessv2, particularly those containing shell metacharacters or unexpected patterns in the apiuser parameter.
  5. Block the three identified attacker IPs (192.42.116.58, 192.42.116.105, 146.70.139.154) at perimeter controls as a tactical measure while patching is completed.

Uncertainties and evidence gaps

  • No confirmed post-compromise activity has been reported; it is not established whether any exploitation attempts have succeeded beyond initial probing observed by eSentire.
  • The ~300 internet-facing LoadMaster instances cited by Shadowserver may include honeypots or already-patched appliances, making true unpatched exposure uncertain.
  • No threat actor or malware family has been attributed to the observed exploitation attempts; the three identified IPs have not been publicly linked to a known group.
  • The CVSS score is inconsistently reported across sources as either 9.6 or 9.8; the authoritative NVD or Progress-published score was not directly confirmed from a fetched primary source.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnauthenticated network access to the LoadMaster API endpoint; no credentials required.
ComponentLoadMaster API /accessv2 endpoint; the apiuser parameter within the HTTP request.
MechanismThe escape_quotes() function allocates an uninitialised heap buffer via malloc() and omits a null terminator after escaped output, causing a subsequent formatting function to read past the buffer boundary into adjacent attacker-influenced heap memory, which reaches a shell execution call.
ImpactRoot-level arbitrary command execution on the LoadMaster appliance, which typically holds a network-edge position with visibility into critical internal services.
DetectionAnomalous or malformed requests to the /accessv2 API endpoint; shell metacharacters or unexpected payload patterns in the apiuser parameter; unexpected outbound connections originating from the appliance.
MitigationUpgrade to LoadMaster GA 7.2.63.2 or LTSF 7.2.54.18; restrict API access to trusted management networks.
Exploitation status

Confirmed active exploitation in the wild; CISA added CVE-2026-8037 to its KEV catalogue on 7 August 2026 following 792 documented attempts from 65 distinct IP addresses across 18 countries over 41 days, beginning the day watchTowr published a functional proof-of-concept on 29 June 2026; no successful post-compromise activity confirmed in cases observed by eSentire.

Research process

Investigation began with the BleepingComputer article and CISA KEV source material, which confirmed active exploitation and identified claims requiring verification: technical root cause, patch details, exploitation timeline, and attacker scope. A web search located the primary authoritative sources—watchTowr Labs, eSentire, SecurityWeek, The Hacker News, and the Canadian CCCS—which were each fetched directly. Together they corroborated exploitation metrics, the precise defective function, and the attacker IP set, while no actor attribution emerged from any source.

  1. What does the BleepingComputer article report about CVE-2026-8037?
    Fetched the BleepingComputer article to extract primary claims.
    bleepingcomputer.com ↗

    Unauthenticated command injection in the LoadMaster API; patches released June 2026; approximately 300 internet-facing instances per Shadowserver; CISA KEV added 7 August 2026 with a three-day FCEB remediation deadline under BOD 26-04.

    why Established baseline facts and identified the exposure count and regulatory deadline as key claims requiring corroboration.

  2. What independent coverage and corroborating data exist for this vulnerability?
    Searched for CVE-2026-8037 across security outlets.

    CISA, SecurityWeek, GBHackers, The Hacker News, eSentire, and watchTowr Labs all cover the event; 792 exploitation attempts from 65 IPs in 18 countries cited by multiple sources; CVSS 9.6 widely reported.

    why Confirmed broad independent corroboration and identified the most authoritative sources to fetch directly.

  3. Does the CISA KEV alert confirm exploitation directly?
    Attempted to fetch the CISA alert page.
    cisa.gov ↗

    HTTP 403 Forbidden; page content not retrievable.

    why CISA KEV addition is confirmed through multiple independent secondary sources; the 403 prevents direct citation but does not undermine the established fact.

  4. What exploitation metrics and technical detail does SecurityWeek provide?
    Fetched the SecurityWeek article.
    securityweek.com ↗

    CVSS 9.6; 792 attempts over 41 days from 65 IPs across 18 countries; exploitation began 29 June; initial attempts were largely unsuccessful; /accessv2 endpoint and apiuser parameter confirmed as attack surface.

    why Provided concrete exploitation telemetry and corroborated the technical mechanism and timeline from an independent outlet.

  5. Does The Hacker News add attacker infrastructure detail?
    Fetched The Hacker News article.
    thehackernews.com ↗

    Corroborated 792 attempts, 65 IPs, 18 countries over 41 days; attacker IPs 192.42.116.58, 192.42.116.105, and 146.70.139.154 cited; eSentire observed no successful post-compromise activity.

    why Independent corroboration of exploitation metrics and attacker IPs; confirmed absence of actor attribution.

  6. Is a public proof-of-concept available and what is its publication date?
    Searched for watchTowr PoC details and publication timeline.

    watchTowr Labs published a full technical write-up with a functional PoC HTTP request on 29 June 2026; exploitation attempts began the same day; CWE-908 and CWE-170 confirmed; /accessv2 and apiuser confirmed entry points.

    why Confirmed PoC existence and established the causal link between its release and the onset of exploitation attempts.

  7. What are the precise patch versions and is there a vendor advisory?
    Searched for GA 7.2.63.2 and LTSF 7.2.54.18 patch references.

    Patch versions GA 7.2.63.2 and LTSF 7.2.54.18 confirmed across multiple sources; Progress Security Advisory AV26-552 identified; Canadian CCCS advisory AV26-552 located.

    why Confirmed the authoritative remediation targets required for defensive guidance.

  8. What technical detail does watchTowr Labs' blog directly disclose?
    Fetched the watchTowr Labs blog post.
    labs.watchtowr.com ↗

    escape_quotes() allocates heap via malloc() without null termination; crafted input overwrites heap allocator metadata; __sprintf_chk() then reads into adjacent sprayed content; system() executes the injected payload; CWE-908 and CWE-170 confirmed; CVE-2026-33691 also noted in the Progress advisory.

    why Primary technical source; provided the precise non-weaponisable mechanism description for the vulnerability_flow and technical_analysis fields.

  9. What does eSentire's advisory reveal about attacker behaviour and success rate?
    Fetched the eSentire security advisory.
    esentire.com ↗

    Attempts confirmed from 29 June 2026; three attacker IPs identified; no successful compromise and no post-exploitation activity observed in eSentire's cases.

    why Most specific operational intelligence on attacker infrastructure; clarified that confirmed exploitation in the KEV sense does not mean confirmed post-compromise success.

  10. Does the Canadian CCCS advisory provide independent government corroboration?
    Fetched the Canadian Centre for Cyber Security advisory AV26-552.
    cyber.gc.ca ↗

    Advisory confirms CVE-2026-8037 as critical and exploited in the wild; CISA KEV addition on 7 August 2026 noted; update 2 issued 7 August 2026; recommends applying vendor patches.

    why Independent government corroboration from a second national cyber authority, strengthening confidence in the exploitation confirmation.

Named in this story
TargetsFortune 500 companiesU.S. Federal Civilian Executive Branch agenciestechnology sectorgovernment entities worldwide
Related CVEs CVE-2026-8037

Research coverage

All 68 registered source leaves were evaluated for this run: 58 completed, 0 were unavailable, 3 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 54 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok10 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research.
CISA KEVkev ok1662 records Primary evidence1 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
FIRST EPSSepss ok7588 records Context1 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web failed0 records Failed The current collection attempt failed; this source cannot support the report.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5322 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok678 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1008 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok12 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok16 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok13 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1453 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok2 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok7 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok8 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch failed3 records Failed The current collection attempt failed; this source cannot support the report.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 5 opened outside the registered collection
References & evidence
Vulnerability & exploitation2
CVE-2026-8037 CISA KEV Progress LoadMaster · added 2026-08-07 CISA catalog ↗
CVE-2026-8037 EPSS 99.3% 100th percentile exploitation probability
PoC & exploit code1
Enterprise Tech In, Shell Out: Progress Kemp LoadMaster Pre-Auth RCE (CVE-2026-8037) – watchTowr Labs labs.watchtowr.com ↗

Full technical write-up with functional proof-of-concept HTTP request published 29 June 2026; exploitation attempts began the same day.

Vendor & gov advisories1
Progress Security Advisory AV26-552 (Update 2) – Canadian Centre for Cyber Security cyber.gc.ca ↗

Government advisory confirming CVE-2026-8037 is critical and exploited in the wild; updated 7 August 2026 to reflect CISA KEV addition.

OSINT / dark-web chatter1
Progress Kemp LoadMaster Vulnerability Targeted (CVE-2026-8037) – eSentire Threat Response Unit esentire.com ↗

Three attacker IPs identified (192.42.116.58, 192.42.116.105, 146.70.139.154); exploitation attempts began 29 June 2026, coincident with PoC release.

Analysis & research3
CISA Urges Immediate Patching of Exploited Progress LoadMaster Vulnerability – SecurityWeek securityweek.com ↗

Detailed reporting including CVSS 9.6 score, attack telemetry (792 attempts, 65 IPs, 18 countries), and technical root cause.

Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts – The Hacker News thehackernews.com ↗

Corroborates full exploitation timeline from June disclosure through CISA KEV addition and identifies the three attacker IPs.

Critical Progress LoadMaster Flaw Now Actively Exploited in Attacks – BleepingComputer bleepingcomputer.com ↗

Confirms ~300 internet-facing instances per Shadowserver and the three-day FCEB patch deadline under BOD 26-04.