Progress Kemp LoadMaster Vulnerability Targeted (CVE-2026-8037)

THE THREAT

Beginning on June 29th, 2026, eSentire’s Threat Response Unit (TRU) identified exploitation attempts targeting the critical Progress Kemp LoadMaster vulnerability CVE-2026-8037. The vulnerability was initially disclosed on June 4th and functional Proof-of-Concept (PoC) exploit code was released on June 29th. CVE-2026-8037 (CVSS: 9.8), is an OS Command Injection Remote Code Execution (RCE) vulnerability which allows an unauthenticated attacker to execute arbitrary commands on the LoadMaster appliance.  

As active exploitation attempts have been identified, it is critical that organizations apply the relevant security patches immediately.

What we’re doing about it 

• eSentire's TRU team has developed detections within eSentire MDR for Network
• The TRU team has conducted threat hunts to identify signs of exploitation
• Known malicious IPs have been added to eSentire's Global Block List
• eSentire Managed Vulnerability Service (MVS) will add the relevant plugins as they become available
• TRU is actively tracking this topic for additional information and detection opportunities 

What you should do about it 

•  After performing a business impact review, apply the relevant security patches 

Additional information

The vulnerability originates from improper handling of user-supplied input within the escape_quotes() function. The vulnerable code allocates heap buffer using malloc() and fails to properly null-terminate escaped strings. This condition allows out-of-bounds reads into adjacent heap memory, which can be manipulated by an attacker to introduce command injection content into a shell command that is executed via the system() function. 

watchTowr Labs demonstrates how specially crafted requests can leverage heap memory manipulation and command injection techniques to achieve RCE without authentication. The vulnerability is reachable through the /accessv2 endpoint when the API is enabled.
 
The impact of successful exploitation is severe. An unauthenticated attacker may be able to execute arbitrary commands on the affected appliance without possessing valid credentials. Because LoadMaster appliances are frequently positioned at the network edge and often have visibility into critical internal services, compromise of the device could facilitate initial access and further malicious activity within the environment.

In cases observed by eSentire, exploitation was not successful, and as such, no post-compromise activity was observed. Due to the availability of PoC exploit code and the potential value for initial access, the eSentire Threat Intelligence team assesses that it is highly probably exploitation attempts targeting CVE-2026-8037 will increase in the immediate future.

References: 

[1]  https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691  

[2] https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/  

[3] https://www.zerodayinitiative.com/advisories/ZDI-26-342/