Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are exploiting a critical-severity Progress Kemp LoadMaster command injection vulnerability. [...]
Analysis Summary
# Vulnerability: Progress Kemp LoadMaster Unauthenticated Remote Command Injection
## CVE Details
- **CVE ID:** CVE-2026-8037
- **CVSS Score:** 10.0 (Critical) - *Based on technical description of unauthenticated RCE.*
- **CWE:** CWE-77 (Improper Neutralization of Special Elements used in a Command) / CWE-78 (OS Command Injection)
## Affected Systems
- **Products:**
- Progress Kemp LoadMaster (Application Delivery Controller)
- MOVEit WAF (Web Application Firewall)
- **Versions:**
- **LoadMaster (GA):** v7.2.63.1 and older
- **LoadMaster (LTSF):** v7.2.54.17 and older
- **MOVEit WAF:** All versions prior to GA v7.2.63.2
- **Configurations:** Systems with management API endpoints exposed to the network.
## Vulnerability Description
CVE-2026-8037 is a critical command injection vulnerability stemming from the improper sanitization of user-provided input within the LoadMaster API. Specifically, multiple command endpoints fail to validate input correctly, allowing an unauthenticated remote attacker to inject and execute arbitrary operating system commands with elevated privileges on the underlying appliance.
## Exploitation
- **Status:** **Actively Exploited in the Wild.** CISA added this flaw to its Known Exploited Vulnerabilities (KEV) catalog in August 2026.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Total (Full access to system data and traffic passing through the ADC)
- **Integrity:** Total (Ability to modify system configurations and intercepted traffic)
- **Availability:** Total (Potential for complete system shutdown or denial of service)
## Remediation
### Patches
Progress Software has released the following security updates:
- **Kemp LoadMaster (GA):** Upgrade to v7.2.63.2 or later.
- **Kemp LoadMaster (LTSF):** Upgrade to v7.2.54.18 or later.
- **MOVEit WAF:** Upgrade to GA v7.2.63.2 or later.
### Workarounds
- **Network Segmentation:** Ensure the LoadMaster management interface and API are not exposed to the public internet.
- **Access Control:** Restrict API access to trusted source IP addresses via firewall rules or ACLs.
## Detection
- **Indicators of Compromise:** Monitor for unusual outbound traffic from LoadMaster appliances or unauthorized administrative shell activity.
- **Detection methods and tools:**
- Review web server/API logs for suspicious characters (e.g., `;`, `|`, `&`, `$()`) in API request parameters.
- CISA recommends federal agencies and organizations use vulnerability scanners to identify unpatched Kemp instances exposed to the web.
## References
- **Vendor Advisory:** hxxps[://]community[.]progress[.]com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691
- **CISA KEV Catalog:** hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- **Shadowserver Statistics:** hxxps[://]dashboard[.]shadowserver[.]org/statistics/iot-devices/time-series/?vendor=progress&model=kemp+loadmaster