CVE-2026-8037: Progress Kemp LoadMaster — Pre-Auth Command Injection RCE

Background

LoadMaster is an application delivery controller (ADC) and load balancer produced by Kemp Technologies, now part of Progress Software. It is deployed by enterprises, government agencies, healthcare organisations, and higher education institutions to distribute traffic across web, application, and API server pools. LoadMaster appliances are typically network-adjacent or internet-facing, handling inbound connections to production workloads.

CVE-2026-8037 is a pre-authentication OS command injection vulnerability in the LoadMaster API. Exploitation requires no credentials and produces remote code execution as root on the appliance. Progress disclosed the vulnerability on 4 June 2026 alongside patches. watchTowr Labs published a full technical write-up with working proof-of-concept code on 29 June 2026. Exploitation attempts were observed in the wild shortly after PoC release. CISA added CVE-2026-8037 to the Known Exploited Vulnerabilities catalogue on 7 August 2026 with a federal remediation deadline of 10 August 2026.

A companion vulnerability, CVE-2026-33691 (CVSS 7.5, high), affecting the OWASP ModSecurity Core Rule Set bundled in LoadMaster’s WAF component, was patched in the same June 2026 bulletin. CVE-2026-33691 is addressed separately at the end of this article.

Technical Mechanism

CWE-78 (Improper Neutralization of Special Elements used in an OS Command — OS Command Injection) is the root cause classification.

The vulnerability originates in the escape_quotes() function in the LoadMaster API’s input handling layer. The function is responsible for sanitising string inputs before they are interpolated into shell commands executed on the appliance.

The root cause is a two-part implementation error:

Uninitialized heap allocation. escape_quotes() allocates its output buffer using malloc() rather than calloc(). malloc() does not zero-initialise the allocated memory; the buffer it returns contains whatever data the heap allocator previously held in that region. The function does not explicitly zero the buffer before use.

Missing null terminator. After processing the input string and building the escaped output, the function fails to write a null terminator at the end of the output buffer. Subsequent string operations on the output read past the intended end of the escaped string, consuming bytes from adjacent heap memory.

An attacker exploits this combination through the API endpoint POST /accessv2. The request body is a JSON object containing fields including apiuser and apipass. The attacker populates apiuser with a crafted string of single quotes (e.g., ''''), which the escape_quotes() function expands to a longer escaped sequence. With a sufficiently sized input, the expanded output overruns the allocated buffer and overwrites metadata for an adjacent heap chunk. The attacker then populates approximately 60 additional JSON fields with a shell command payload. Due to the missing null terminator, the string operation that builds the shell command for execution reads from the overwritten region, incorporating the injected payload.

The resulting shell command runs as root. A minimal exploitation skeleton, as documented in the watchTowr Labs analysis:

POST /accessv2 HTTP/1.1
Host: <target>
Content-Type: application/json

{
  "apiuser": "''''",
  "apipass": "BBBBB",
  "g0": "AAAAAAA'; id #",
  "g1": "AAAAAAA'; id #",
  ... (repeated ~60 entries for reliable heap spray)
}

The patch corrects both errors: malloc() is replaced with calloc() (which zero-initialises the allocation), and an explicit null terminator *end = 0 is added after output construction. Neither fix requires any configuration change; applying the patched firmware version addresses the vulnerability.

Real-World Exploitation Evidence

CISA added CVE-2026-8037 to the Known Exploited Vulnerabilities catalogue on 7 August 2026, with a three-day federal remediation deadline of 10 August 2026.

Active exploitation began within hours of the watchTowr Labs PoC publication on 29 June 2026. eSentire’s Threat Response Unit reported scanning and exploitation attempts originating from multiple IP addresses, including 192.42.116[.]58, 192.42.116[.]105, and 146.70.139[.]154. As of eSentire’s reporting, no confirmed post-exploitation compromise was attributed to these campaigns, though the absence of confirmed success does not indicate the vulnerability is not being successfully exploited in unmonitored environments.

EPSS scoring for CVE-2026-8037 places it at approximately the 100th percentile for exploitation probability among tracked vulnerabilities, consistent with the combination of pre-authentication access, trivial exploitation mechanics, public PoC, and active exploitation evidence.

No specific threat actor group has been publicly attributed to the in-the-wild exploitation at this time.

Impact Assessment

Successful exploitation gives an unauthenticated remote attacker root-level code execution on the LoadMaster appliance. Because LoadMaster sits at the network boundary — distributing traffic across production web, application, and API server pools — a compromised appliance gives an attacker control over all traffic flowing through it. This enables traffic interception, manipulation of requests and responses at scale, and a privileged network position for lateral movement into internal infrastructure.

At root, the attacker can establish persistent implants (reverse shells, cron jobs, dropped binaries), pivot to backend systems that trust the load balancer, and stage or exfiltrate data from traffic transiting the appliance. For healthcare, government, and financial sector deployments, the potential for disruption of availability and interception of sensitive data in flight is significant.

Affected Versions

Exploitation requires the LoadMaster API to be enabled. The API is enabled by default in many deployment configurations. Instances exposed directly to the internet are at highest risk; appliances reachable only from internal networks remain at meaningful risk from lateral movement or insider threat scenarios.

Remediation Steps

1. Upgrade immediately to the fixed firmware version:

   Channel	Upgrade to
   LoadMaster GA	7.2.63.2 or later
   LoadMaster LTSF	7.2.54.18 or later

   Firmware updates are available through the Progress/Kemp customer portal and via the LoadMaster management interface’s built-in update mechanism. The June 2026 security bulletin on the Progress Community site (linked in CISA KEV notes) provides direct download links.

2. If patching cannot be completed immediately:

   • Disable the LoadMaster API if it is not required for operational management. The API is accessed via the management interface, typically on a dedicated management port or VLAN.
   • If the API must remain enabled, restrict access using firewall rules or ACLs to allow only authorised management hosts to connect to the API endpoint. This is a compensating control, not a fix; patching remains required.

3. Review network architecture to confirm whether the LoadMaster management interface (and API) is exposed to the internet or accessible from less-trusted network segments. Where internet exposure exists and cannot be immediately removed, treat the appliance as potentially compromised pending patch application and forensic review.

Detection Guidance

Log analysis. Examine LoadMaster API access logs for POST requests to /accessv2 originating from unexpected IP addresses, particularly those with unusually long request bodies or high volumes of repeated keys. Successful exploitation produces a single HTTP response; failed attempts may produce 400 or 500 errors depending on how far the heap manipulation progresses.

Network traffic. Monitor for outbound connections from the LoadMaster management IP to external infrastructure following API activity. Post-exploitation typically involves establishing persistence (reverse shell, cron job, implant dropped to disk) and may include data exfiltration or lateral movement probing.

Known attacker IPs. Block and alert on traffic from the IPs reported by eSentire: 192.42.116[.]58, 192.42.116[.]105, 146.70.139[.]154. These are not authoritative or exhaustive — campaigns typically rotate infrastructure.

File system integrity. On LoadMaster appliances where file system access is available, check for unexpected files in common persistence locations: /etc/cron.d/, /etc/rc.local, /tmp/, and web-accessible directories under the management interface root. The watchTowr Labs report notes that the restricted firmware environment limits some post-exploitation paths, but root access is sufficient to write files anywhere on the appliance.

Indicator of compromise baseline. Appliances running LoadMaster GA earlier than 7.2.63.2 or LTSF earlier than 7.2.54.18 with API access logs showing any unexpected POST to /accessv2 before the patch was applied should be treated as potentially compromised and reviewed forensically before being returned to service.

Timeline

Companion vulnerability: CVE-2026-33691 (WAF bypass)

CVE-2026-33691 is a separate vulnerability affecting the OWASP ModSecurity Core Rule Set (CRS) bundled in the LoadMaster WAF component. It is classified as CVSS 7.5 high by NIST.

The vulnerability allows file upload extension filter bypass by inserting whitespace characters into filenames. For example, a file named shell. php or shell.php (trailing space) passes extension regex checks that match on .php as a literal suffix. When the file is written to disk or processed, the operating system or application trims the whitespace, resulting in the file being treated as executable PHP. The bypass can be chained to upload a malicious .htaccess or other configuration file that disables WAF rules for a directory, enabling subsequent unrestricted file upload.

CVE-2026-33691 is patched in OWASP CRS v3.3.9 and v4.25.0; Progress applied the fix to the LoadMaster-bundled CRS in the June 2026 bulletin. The same firmware update that resolves CVE-2026-8037 also resolves CVE-2026-33691. CVE-2026-33691 is not independently listed in the CISA KEV catalogue as of publication.

References

• Progress Community Security Bulletin — June 2026 (CVE-2026-8037, CVE-2026-33691)
• NVD — CVE-2026-8037
• NVD — CVE-2026-33691
• watchTowr Labs — Technical Analysis and PoC
• eSentire Threat Response Advisory
• GitHub Advisory GHSA-57pc-jm9r-hgj4
• CISA KEV — CVE-2026-8037