Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical-severity security flaw impacting Progress Kemp LoadMaster to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. The vulnerability, tracked as CVE-2026-8037 (CVSS score: 9.6), is a command injection flaw that could be weaponized to achieve arbitrary
Analysis Summary
# Vulnerability: Progress Kemp LoadMaster Command Injection
## CVE Details
- **CVE ID:** CVE-2026-8037
- **CVSS Score:** 9.6 (Critical)
- **CWE:** CWE-77 (Improper Neutralization of Special Elements used in a Command) / Command Injection
## Affected Systems
- **Products:** Progress Kemp LoadMaster
- **Versions:** Susceptible versions include those released prior to the June 2026 security updates.
- **Configurations:** Appliances with management interfaces or command endpoints accessible to the network.
## Vulnerability Description
The vulnerability is a command injection flaw originating from improper handling of user-supplied input. Specifically, the flaw exists within a function named `escape_quotes()` used by the load balancer application. Because the application fails to properly sanitize input across multiple command endpoints, an unauthenticated attacker can bypass security controls to execute arbitrary system commands on the underlying LoadMaster appliance.
## Exploitation
- **Status:** Exploited in the wild (Added to CISA KEV catalog).
- **Exploitation Attempts:** 792 reported attempts from 65 unique IP addresses across 18 countries.
- **Complexity:** Low (Requires no authentication or valid credentials).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** Total (Full access to system data and credentials).
- **Integrity:** Total (Ability to modify system configurations and files).
- **Availability:** Total (Ability to shut down or disrupt load balancing services).
## Remediation
### Patches
- Progress released patches for this vulnerability in June 2026. Users should ensure they are running the latest firmware version provided by the vendor.
- FCEB agencies are mandated by CISA to apply patches by **August 10, 2026**.
### Workarounds
- Restrict access to the LoadMaster management interface to trusted internal networks only.
- Implement strict firewall rules to block unauthorized traffic to management endpoints.
## Detection
### Indicators of Compromise (IoCs)
The following IP addresses have been identified as sources of exploitation attempts:
- `192.42.116[.]58`
- `192.42.116[.]105`
- `146.70.139[.]154`
### Detection Methods and Tools
- **Log Analysis:** Monitor web server and management logs for unusual characters in URI strings (e.g., backticks, semicolons, or shell metacharacters) associated with the `escape_quotes()` function.
- **Telemetry:** Use KEVIntel or similar threat intelligence platforms to monitor for exploitation attempts targeting CVE-2026-8037.
## References
- **Vendor Advisory:** Progress Software (Kemp) Official Support Portal.
- **CISA KEV Catalog:** hxxps://www.cisa[.]gov/known-exploited-vulnerabilities-catalog
- **watchTowr Labs Analysis:** hxxps://labs.watchtowr[.]com/ (June 2026 report)
- **Security News:** hxxps://thehackernews[.]com/2026/08/progress-kemp-loadmaster-flaw-hits-cisa.html