Progress MOVEit WAF

ESentire's Threat Response Unit reports that in-the-wild exploitation attempts against CVE-2026-8037, the Progress Kemp LoadMaster pre-auth OS command-injection flaw reachable through the /accessv2 API endpoint (CVSS 9.6–9.8), began 2026-06-29, the same day a public proof-of-concept was released, confirming the compressed PoC-to-exploitation timeline (eSentire TRU, 2026-06-30).

In the cases eSentire observed, exploitation was not successful and no post-compromise activity followed, and eSentire assesses that exploitation attempts are highly likely to increase in the immediate future (eSentire TRU, 2026-06-30). Affected versions remain LoadMaster GA 7.2.60.0 through 7.2.63.1 and LTSF 7.2.54.12 through 7.2.54.17 (ENISA EUVD, 2026-06-04); Progress shipped patched firmware in early June 2026. Patch remains the primary mitigation; disabling the LoadMaster API where not required removes the /accessv2 attack surface entirely. By inference from the published exploit, hunt /accessv2 traffic for malformed or oversized parameters.

CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalog on 2026-08-07, "based on evidence of active exploitation" (CISA, 2026-08-07). The catalog record (CISA KEV catalog, 2026-08-07) describes the flaw as a command injection that "allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints," classes it CWE-77, and records known ransomware-campaign use as unknown (CISA KEV catalog, 2026-08-07).

The delta is the status, not the mechanics. eSentire reported exploitation attempts beginning the day the proof-of-concept dropped, none of them successful and with no post-compromise activity (eSentire TRU, 2026-06-30), and a federal catalog entry asserting active exploitation is a different claim, arriving five weeks later. Nothing in the affected estate has changed: watchTowr Labs gives the vulnerable version range as "Kemp LoadMaster: GA v7.2.63.1 and older" together with the LTSF release v7.2.54.17 and older, in both cases only when the API is enabled (watchTowr Labs, 2026-06-29). No authority has named an exploiting cluster or described an observed intrusion path.

The catalog's remediation due date is a US federal compliance clock and carries no weight here. What does carry weight is the interval: a public exploit has existed since late June against an appliance class that terminates traffic at the network edge, and the flaw needs nothing but reachability to the API. An organisation that patched in June is fine. An organisation that has been treating this as a scheduled item now has a gap between the PoC and its own patch date during which a working, public exploit was being fired at exposed instances.

watchTowr's published exploit is an unauthenticated POST request to the /accessv2 endpoint (watchTowr Labs, 2026-06-29); by inference from that request, in reverse-proxy or web-application-firewall logs in front of the management API, such requests carrying malformed or oversized parameters are the shape to hunt. Triage: legitimate LoadMaster API clients authenticate and send well-formed payloads from a small, stable set of management sources. The discriminator is parameter content in unauthenticated requests to /accessv2 that is malformed rather than merely unexpected, not the request itself. Hardening is unchanged and still the strongest control available: disable the LoadMaster API where it is not required, which removes the endpoint entirely, and keep the management interface off any general-purpose network.