Critical LoadMaster Vulnerability Exploited in the Wild, CISA Warns of Immediate Patching
The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a urgent warning to federal agencies to patch a critical vulnerability in Progress Kemp LoadMaster that has been actively exploited by attackers. The flaw, tracked as CVE-2026-8037 with a CVSS score of 9.6, is a remote code execution (RCE) bug that can be triggered without authentication, making it a high-risk threat.
The vulnerability affects LoadMaster appliances, which are often used to manage and secure network connections. According to Progress’ advisory, an attacker can exploit the bug by injecting malicious code through unsanitized API inputs on the accessv2 endpoint. This allows them to execute arbitrary commands on the appliance in the context of root, effectively granting them complete control over the system.
The issue is linked to a specific function in LoadMaster’s GA version 7.2.63.1 and older, as well as LoadMaster LTSF version 7.2.54.17 and older. The problem lies in how the escape_quotes() function handles user-supplied input, failing to properly initialize memory before accessing it. This leads to out-of-bounds reads from neighboring freed memory, which can be exploited by an attacker to spray command injection content into adjacent memory.
Attack surface management company watchTowr first disclosed technical information and proof-of-concept (PoC) code for the vulnerability on June 29, likely marking the start of in-the-wild exploitation. Cybersecurity firm eSentire warned that hackers began exploiting CVE-2026-8037 immediately after the analysis was published, although initial attempts were not successful.
However, with the technical details now publicly available, it is only a matter of time before more sophisticated attackers succeed in exploiting the vulnerability. CISA has added the CVE to its Known Exploited Vulnerabilities (KEV) catalog, giving federal agencies just three days to patch the issue.
The exploitation of this vulnerability highlights the importance of regular security updates and patches for critical infrastructure systems like LoadMaster. As eSentire noted, compromise of these devices can facilitate initial access and further malicious activity within an environment. With the summer season of holiday travel and vacation time looming, it is essential that organizations prioritize patching this vulnerability to prevent potential breaches.
In light of this urgent warning, we recommend that all organizations using LoadMaster appliances take immediate action to apply available patches or updates. Additionally, consider implementing additional security measures such as intrusion detection systems (IDS) and network segmentation to minimize the impact in case of a successful attack. Remember that prevention is key: stay up-to-date with security advisories, patch vulnerabilities promptly, and maintain robust security practices to protect your network from emerging threats.
Source: SecurityWeek — 2026-08-10