Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical-severity security flaw impacting Progress Kemp LoadMaster to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild.
Intelligence analysis by Llama
A critical-severity security flaw impacting Progress Kemp LoadMaster has been added to the CISA's Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. The vulnerability, tracked as CVE-2026-8037, is a command injection flaw that could be weaponized to achieve arbitrary code execution on susceptible devices.
Imagine you have a super powerful computer that can do lots of things, but someone finds a way to trick it into doing something bad. That's basically what's happening with the Progress Kemp LoadMaster flaw. Someone is trying to trick the computer into doing something bad, and it's not working very well, but it's still a problem.
Analysis
CISA Adds Progress Kemp LoadMaster Flaw to KEV Catalog After 792 Reported Exploit Attempts
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical-severity security flaw impacting Progress Kemp LoadMaster to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. The vulnerability, tracked as CVE-2026-8037 (CVSS score: 9.6), is a command injection flaw that could be weaponized to achieve arbitrary code execution on susceptible devices.
According to CISA, the vulnerability is present in a function named "escape_quotes()" within the load balancer application and stems from improper handling of user-supplied input, ultimately enabling command injection. Successful exploitation of the flaw can allow an unauthenticated attacker to run arbitrary commands on the affected appliance without having to possess valid credentials.
The addition comes a little over a month after eSentire said it's seeing active exploitation efforts targeting the flaw, although it noted those efforts were largely unsuccessful. The attacks originated from the following IP addresses, per the Canadian security vendor - 192.42.116[.]58, 192.42.116[.]105, and 146.70.139[.]154.
According to telemetry data captured by KEVIntel, a total of 792 exploitation attempts have been observed over the last 41 days from 65 unique IP addresses from 18 countries, including Australia, China, Indonesia, Japan, Poland, and the U.S. The last activity was recorded on August 4, 2026, when five exploitation attempts were detected.
In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the necessary patches by August 10, 2026, to secure their networks in accordance with Binding Operational Directive (BOD) 26-04.
Key points
- A critical-severity security flaw impacting Progress Kemp LoadMaster has been added to the CISA's Known Exploited Vulnerabilities (KEV) catalog.
- The vulnerability, tracked as CVE-2026-8037, is a command injection flaw that could be weaponized to achieve arbitrary code execution on susceptible devices.
- A total of 792 exploitation attempts have been observed over the last 41 days from 65 unique IP addresses from 18 countries.
- Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the necessary patches by August 10, 2026, to secure their networks in accordance with Binding Operational Directive (BOD) 26-04.
If the patches are applied by August 10, 2026, as recommended by CISA, it's likely that the number of exploitation attempts will decrease, and the vulnerability will be mitigated.
If the patches are not applied by August 10, 2026, it's likely that the number of exploitation attempts will continue to rise, and the vulnerability will remain a significant threat to networks.
