CVE-2026-8037: Progress LoadMaster Flaw Added to CISA KEV

CVE-2026-8037 has moved from a critical vulnerability disclosure to an active enterprise security priority.

The vulnerability affects Progress Kemp LoadMaster and can allow an unauthenticated attacker to execute arbitrary commands on a vulnerable appliance. After reports of exploitation activity, CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog.

The urgency is reinforced by reported KEVIntel telemetry documenting 792 exploitation attempts over 41 days. For organizations running affected LoadMaster deployments, the immediate priorities are to verify versions, assess exposure, apply Progress-provided fixes and investigate for evidence of successful exploitation.

CVE-2026-8037 at a glance

CVE-2026-8037 added to CISA KEV after reported exploitation

Progress disclosed CVE-2026-8037 in June 2026 as an OS command injection remote code execution vulnerability affecting its ADC products, including Kemp LoadMaster.

The vulnerability carries a vendor-assigned CVSS 3.1 score of 9.6. An unauthenticated attacker who can reach an affected interface can potentially execute arbitrary commands on a vulnerable appliance.

That made the vulnerability a serious issue when it was disclosed. Its subsequent inclusion in CISA’s Known Exploited Vulnerabilities catalog changes the operational priority.

Inclusion in the KEV catalog indicates that CISA has reliable evidence the vulnerability has been exploited in the wild. Defenders must therefore treat CVE-2026-8037 as more than a theoretical weakness that researchers identified during security testing.

Organizations running LoadMaster should immediately check whether they still operate affected releases and expose vulnerable interfaces to untrusted networks.

What is CVE-2026-8037?

CVE-2026-8037 is an OS command injection vulnerability in Progress Kemp LoadMaster that can result in pre-authentication remote command execution when the affected REST API interface is enabled and reachable. Research into the vulnerability demonstrated exploitation through the /accessv2 API endpoint.

At a high level, the problem involves how LoadMaster processes attacker-controlled input before that input reaches operating system commands.

The vendor description characterizes the vulnerability as command injection through unsanitized input. Research from watchTowr Labs exposed a more specific implementation problem inside the LoadMaster escape_quotes() function.

The flaw ultimately allows carefully crafted input to escape its intended handling and become part of a command executed by the appliance.

Because authentication is not required for the vulnerable path, organizations should determine whether the REST API interface was enabled and whether the affected endpoint was reachable from untrusted networks.

How LoadMaster’s escape_quotes() flaw leads to command execution

The technical mechanism behind CVE-2026-8037 is one of the most distinctive aspects of the vulnerability.

LoadMaster uses an escape_quotes() function to process user-controlled strings before incorporating them into shell commands. The function attempts to escape single quotes so that supplied input cannot alter the intended command.

The vulnerable implementation contained two related memory-handling problems. First, escape_quotes() allocated its destination buffer using malloc(), leaving the newly allocated memory uninitialized. Second, after constructing the escaped string, the function did not explicitly append a terminating null byte.

That combination mattered because C-style string-processing functions rely on a null byte to determine where a string ends. Without guaranteed null termination, subsequent processing could read beyond the intended string and into adjacent heap memory.

watchTowr demonstrated that an attacker could manipulate the surrounding heap contents so that attacker-controlled data appeared beyond the intended buffer. Subsequent string processing could then continue into that data because the escaped string lacked its proper terminator.

The result was more than an out-of-bounds read. The manipulated content could eventually become part of a shell command passed to system(), providing a path to unauthenticated remote command execution.

The patched implementation addresses both conditions by using calloc() for zero-initialized allocation and explicitly writing the terminating null byte.

This chain, from incorrect heap-string handling inside escape_quotes() to command execution, makes CVE-2026-8037 more specific than a routine input-validation failure.

Which Progress LoadMaster versions are affected?

Progress released fixes for CVE-2026-8037 on June 4, 2026.

For LoadMaster, organizations should verify their exact release branch against the latest Progress security guidance.

Relevant corrected LoadMaster releases include:

• LoadMaster GA 7.2.63.2
• LoadMaster LTSF 7.2.54.18

The CVE record also identifies affected Progress products beyond LoadMaster, including ECS Connections Manager, Object Scale Connection Manager and MOVEit WAF.

During triage, teams should avoid treating the presence of an affected version as proof of compromise.

Instead, answer three separate questions:

1. Is an affected product and version deployed?
2. Was the vulnerable interface reachable by an attacker?
3. Is there evidence that exploitation succeeded?

That distinction helps security teams move from vulnerability identification to evidence-based incident investigation.

What the 792 LoadMaster exploitation attempts tell us

The exploitation telemetry for this vulnerability stands out. KEVIntel telemetry recorded 792 exploitation attempts over 41 days.

The reported exploitation attempts were associated with 65 unique IP addresses across 18 countries. The latest activity in the cited telemetry was recorded on August 4, 2026, when five attempts were detected.

These figures show sustained interest, but defenders must interpret them carefully. An exploitation attempt differs from a successful compromise.

The telemetry does not prove attackers breached 792 LoadMaster appliances. In the cases observed by eSentire, exploitation was unsuccessful and no post-compromise activity was observed.

No public reports link this activity to a specific threat actor or campaign. Therefore, defenders should not view this telemetry as a confirmed compromise count.

Instead, it provides evidence of sustained real-world exploitation attempts targeting CVE-2026-8037. Teams should prioritize the vulnerability accordingly.

What enterprises should do about CVE-2026-8037

The primary response to CVE-2026-8037 is to remediate the vulnerable Progress product itself.

Security teams should prioritize the following actions:

1. Inventory LoadMaster deployments. Identify deployed appliances and determine their exact software versions.
2. Validate exposure. Establish whether affected interfaces were or remain accessible from untrusted networks.
3. Apply Progress security updates. Upgrade affected LoadMaster deployments to the appropriate fixed release for their branch.
4. Review appliance and network telemetry. Examine available logs and network records for suspicious requests or activity involving affected interfaces.
5. Investigate possible downstream activity. If evidence suggests successful command execution, examine systems accessible from or interacting with the affected appliance.
6. Review administrative access. Confirm that endpoints and identities used to administer critical network infrastructure are appropriately managed and restricted.

Compensating controls can reduce surrounding risk, but they should not be treated as substitutes for applying the vendor’s remediation.

Where Hexnode fits after suspected LoadMaster exploitation

CVE-2026-8037 must be remediated using the appropriate Progress-provided security update. Hexnode does not patch the vulnerable LoadMaster appliance itself.

Hexnode becomes relevant around the managed endpoints connected to the incident response. If available evidence suggests that exploitation succeeded, security teams may need to investigate whether suspicious activity extended to managed endpoints. Organizations can also review the security posture of endpoints used by administrators to manage LoadMaster and other critical infrastructure.

Where Hexnode applies in this incident

The scope distinction is important in this incident. Hexnode does not patch CVE-2026-8037 on the LoadMaster appliance or directly detect exploitation within LoadMaster. The Progress-provided security update remains the primary remediation. Hexnode becomes relevant if the investigation extends to managed endpoints. Hexnode XDR can support investigation and response to suspicious endpoint activity, while Hexnode UEM can help maintain the security and patch posture of supported devices used to administer critical infrastructure.

Investigating downstream endpoint activity with Hexnode XDR

If appliance or network telemetry indicates that exploitation may have succeeded, the investigation may need to expand beyond LoadMaster. This can include looking for potential post-exploitation activity on managed endpoints, such as suspicious process execution, unexpected network connections, malicious file activity or signs of lateral movement.

Hexnode XDR can support investigation on managed endpoints that may be relevant to the incident. Security teams can review historical endpoint events and examine process relationships through process-tree analysis. They can also use endpoint queries to gather additional endpoint information.

If malicious activity is identified on supported endpoints, response options can include isolating the affected device, terminating malicious processes and quarantining malicious files.

The boundary is important: Hexnode XDR does not detect CVE-2026-8037 exploitation inside the LoadMaster appliance. Its role in this scenario is to support investigation and response on managed endpoints when suspected compromise may have extended beyond the edge appliance.

Strengthening LoadMaster administrative endpoints with Hexnode UEM

Critical network infrastructure such as LoadMaster is typically administered from IT management endpoints. Those endpoints represent a separate part of the security boundary surrounding the appliance.

Hexnode UEM can help organizations maintain the posture of supported managed devices through device management, policy enforcement, compliance controls and supported patch-management capabilities.

For endpoints used to administer LoadMaster and other critical infrastructure, organizations can enforce required security configurations and assess whether managed devices meet defined compliance requirements.

These controls do not remediate CVE-2026-8037 or prevent exploitation of an exposed, vulnerable LoadMaster appliance. Their role is to strengthen the endpoints administrators use to manage sensitive infrastructure while the LoadMaster vulnerability itself is addressed through Progress-provided updates.

Featured resource

Hexnode UEM for Patch Management

See how Hexnode UEM helps IT teams automate patch deployment, track patch compliance and gain visibility into vulnerabilities across managed Windows and macOS endpoints.

Download the One-pager

CVE-2026-8037: What defenders should take away

The defining feature of CVE-2026-8037 is not simply its critical CVSS score.

Progress had already disclosed and patched the vulnerability in June. Since then, researchers demonstrated a viable pre-authentication remote command execution path. Security teams reported active exploitation attempts, and CISA subsequently added the vulnerability to its KEV catalog.

That progression changes how enterprises should approach the issue.

Organizations running Progress Kemp LoadMaster must verify affected versions and exposure. They should apply the appropriate vendor update immediately. Additionally, security teams must examine available telemetry for signs that attackers attempted exploitation.

Where evidence suggests successful exploitation, the response should expand from vulnerability management into incident investigation. This can include examining endpoints and other internal systems that may be relevant to the suspected compromise.

CVE-2026-8037 is also a reminder that edge infrastructure requires both rapid vulnerability remediation and visibility into what happens beyond the edge if exploitation succeeds.