Command injection flaw in Progress Kemp LoadMaster appliances actively exploited in the wild

Summary

Progress Software's Kemp LoadMaster, a widely used Application Delivery Controller (ADC), is currently being targeted by attackers exploiting a critical command injection vulnerability. The flaw allows unauthenticated users to execute arbitrary commands on vulnerable appliances by targeting unsanitized API inputs across multiple endpoints.

CISA added the vulnerability, tracked as CVE-2026-8037, to its Known Exploited Vulnerabilities (KEV) catalog on August 7, 2026. Under Binding Operational Directive 26-04, U.S. Federal Civilian Executive Branch (FCEB) agencies must secure their servers by August 10, 2026. While the directive applies to federal entities, CISA advises all organizations to prioritize these updates due to the high risk posed by the flaw.

Technical details

The vulnerability exists within the API of the LoadMaster appliance. Specifically, several command endpoints fail to properly sanitize incoming inputs, which enables an unauthenticated attacker to inject and execute malicious commands.

This flaw impacts a wide range of deployments used for distributing web traffic and optimizing application performance across various sectors, including government and large-scale tech enterprises. According to Internet threat watchdog Shadowserver, nearly 300 Kemp LoadMaster instances are currently exposed online, though the number of successfully compromised or secured systems remains unknown.

Affected products and fixed versions

The vulnerability affects multiple versions of Progress software. Users should verify their current version and upgrade to the following patched releases:

Why this matters for defenders

Load balancers and ADCs sit at the edge of a network, often serving as the first point of contact for incoming web traffic. A successful exploit grants an attacker total control over the appliance, which can be used to intercept traffic, pivot into internal networks, or disrupt service availability.

Because the attack requires no authentication, even a single unpatched instance exposed to the internet provides a direct entry point for malicious actors. For federal agencies, the speed of remediation is critical; CISA's mandate emphasizes that these assets are high-priority targets because they grant full control over the system post-exploitation.

Defender guidance

Immediate action is required for any organization running Kemp LoadMaster or MOVEit WAF.

• Apply Patches: Upgrade all LoadMaster appliances to GA v7.2.63.2 or later. For those on Long Term Support (LTSF) tracks, ensure you are running the most recent security update provided by Progress.
• Verify Exposure: Identify all internet-facing LoadMaster instances and confirm they have been updated.
• Conduct Forensics: Following CISA's guidance for KEV-listed vulnerabilities, agencies should evaluate whether their systems were compromised before the patch was applied. This includes checking for unauthorized configuration changes or suspicious activity in system logs.