Skip to content

Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

Summary

CVE-2026-8037 is a pre-authentication remote-code-execution vulnerability in Progress Kemp LoadMaster when the API is enabled. Progress disclosed the issue in a June 2026 LoadMaster security bulletin; watchTowr Labs published a technical analysis on June 29, 2026 showing how the bug can be driven through the /accessv2 API endpoint. On June 30, 2026, eSentire's Threat Response Unit reported active exploitation attempts that began June 29, 2026. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 7, 2026, with an August 10 federal remediation deadline.

watchTowr describes the flaw as an uninitialized-memory bug in LoadMaster's API credential handling, not a simple shell metacharacter escaping miss. An unauthenticated request can use the apiuser field, JSON heap spraying, and adjacent uninitialized heap content to smuggle a command-injection payload into the command constructed by the access executable.

Tags

Why this matters

  • Load balancers and application delivery controllers often sit at the network edge and terminate high-value application traffic; compromise can become an ingress, credential, traffic-inspection, or pivot point.
  • The exploit path is reachable before authentication when the API is enabled, so internet-exposed or partner-exposed management/API surfaces deserve emergency review.
  • watchTowr's analysis includes enough exploit mechanics to make defender exposure reduction urgent; eSentire subsequently observed active exploitation attempts against CVE-2026-8037 beginning June 29, 2026.
  • CISA's August 7 KEV addition upgrades the public exploitation signal from one provider's failed attempts to a federal known-exploitation determination. The catalog does not identify victims, successful post-exploitation, actor, infrastructure, or payload.
  • Appliance compromise routinely has weak endpoint telemetry. Treat exposed vulnerable LoadMaster systems as incident-response objects, not just patching tickets.

Public vulnerability detail

  • Product: Progress Kemp LoadMaster load balancer / application delivery controller.
  • Vulnerability: CVE-2026-8037, described by Progress as a command-injection remote-code-execution issue and by watchTowr as an apiuser uninitialized-memory path to command injection.
  • Companion bulletin item: Progress's June 2026 bulletin title also references CVE-2026-33691; keep both CVEs in asset and ticket searches until vendor-specific applicability is confirmed.
  • Access requirement: remote, unauthenticated access to the LoadMaster API when the API is enabled.
  • Affected versions named by watchTowr: Kemp LoadMaster GA v7.2.63.1 and older; Kemp LoadMaster LTSF v7.2.54.17 and older.
  • Patched version diffed by watchTowr: GA v7.2.63.2; use the Progress bulletin as source of truth for branch-specific fixed versions and upgrade paths.
  • Endpoint discussed publicly: POST /accessv2 with JSON fields including cmd, apiuser, and apipass.
  • Exploit mechanics in public analysis: single-quote expansion in apiuser, a missing null terminator / uninitialized heap read condition, heap spraying through additional JSON key/value pairs, and command injection after adjacent heap placement.

Active exploitation attempts

  • Observed activity: eSentire TRU reported exploitation attempts targeting CVE-2026-8037 beginning June 29, 2026.
  • Outcome caveat: eSentire said the attempts it observed failed and did not produce post-compromise activity; the signal still matters because public PoC-level mechanics and technical detail are now available.
  • Attacker IPs reported by eSentire: 192.42.116[.]58, 192.42.116[.]105, and 146.70.139[.]154.
  • Operational implication: internet-facing or partner-accessible LoadMaster API surfaces should be treated as actively probed/exploited, not merely theoretically vulnerable.
  • External sensor measurement: KEVIntel reported 792 attempts from 65 source IPs across 18 countries during a 41-day observation window, with its latest recorded activity on August 4. Treat this as one sensor network's attempt count, not a victim count or proof that 792 compromises succeeded.

CISA KEV update — August 7, 2026

CISA added CVE-2026-8037 to the Known Exploited Vulnerabilities catalog on August 7 and set an August 10 due date. The required action is to apply vendor mitigations under BOD 26-04 risk-based prioritization and CISA's forensic-triage requirements, or discontinue use if mitigations are unavailable. CISA lists known ransomware-campaign use as Unknown.

The KEV entry describes unauthenticated arbitrary-command execution through unsanitized input in multiple command endpoints, while the public watchTowr path is specifically /accessv2 with API access enabled. Responders should therefore avoid limiting retrospective review to one literal path if other API or management request telemetry is available. The KEV record does not publish request samples, new source IPs, post-exploitation artifacts, or a successful-victim count.

Defender heuristics

  1. Inventory Progress Kemp LoadMaster deployments, including virtual appliances, cloud images, disaster-recovery instances, partner-accessible systems, and management/API interfaces behind reverse proxies.
  2. Determine whether the API is enabled. If API access is enabled on GA v7.2.63.1 or older, or LTSF v7.2.54.17 or older, treat the system as an emergency patch and exposure-reduction candidate.
  3. Apply Progress's June 2026 LoadMaster fixes or the appropriate later fixed branch. If patching cannot be immediate, restrict API and management access to a tightly scoped administrative network or VPN allow-list.
  4. For US federal systems, meet CISA's August 10, 2026 KEV deadline and preserve the forensic artifacts required by BOD 26-04 implementation guidance. Other organizations should use the same deadline as an emergency prioritization signal.
  5. Preserve appliance, reverse-proxy, VPN, WAF, firewall, and load-balancer logs before rebooting or rebuilding, especially request logs for /accessv2 and other command-capable API endpoints.
  6. Hunt for unauthenticated or anomalous POST /accessv2 requests, JSON bodies with unusual apiuser values, many additional JSON keys, quote-heavy strings, command separators, shell fragments, or repeated malformed API calls.
  7. Add the eSentire-reported source IPs to retrospective searches and perimeter telemetry (192.42.116[.]58, 192.42.116[.]105, 146.70.139[.]154), but do not rely on IP-only blocking because follow-on exploitation can easily shift infrastructure.
  8. Review appliance configuration, virtual service definitions, certificate stores, local users, API users, admin sessions, backups, and recently changed health checks or scripts.
  9. Check for outbound connections, unexpected DNS lookups, file writes, cron or startup persistence, new accounts, web shells, altered firmware/package state, or tampered logs on the appliance and adjacent management hosts.
  10. Rotate credentials and certificates accessible to the LoadMaster after containment, including API credentials, local admin passwords, private keys, upstream service credentials, and any secrets stored in virtual-service configuration.
  11. For internet-facing deployments, consider threat-hunting the downstream application environment for traffic replay, credential capture, injected headers, or route/configuration changes during the exposure window.

Sources