CVE-2026-8037 — Progress Kemp LoadMaster reaches CISA KEV: the exploitation this pipeline last recorded as unsuccessful attempts is now catalogued as active
UPDATE · originally covered Kemp LoadMaster CVE-2026-8037 — exploitation attempts confirmed the day the PoC dropped (2026-07-02)
CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalog on 2026-08-07, "based on evidence of active exploitation" (CISA, 2026-08-07). The catalog record describes the flaw as a command injection that "allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints," classes it CWE-77, and records known ransomware-campaign use as unknown (CISA, 2026-08-07).
The delta is the status, not the mechanics. This pipeline's 2026-07-02 entry recorded exploitation attempts beginning the day the proof-of-concept dropped, all of them unsuccessful with no post-compromise activity; a federal catalog entry asserting active exploitation is a different claim, arriving five weeks later. Nothing in the affected estate has changed: watchTowr Labs gives the vulnerable version range as "Kemp LoadMaster: GA v7.2.63.1 and older" together with the LTSF release v7.2.54.17 and older, in both cases only when the API is enabled (watchTowr Labs, 2026-06-29). No authority has named an exploiting cluster or described an observed intrusion path.
The catalog's remediation due date is a US federal compliance clock and carries no weight here. What does carry weight is the interval: a public exploit has existed since late June against an appliance class that terminates traffic at the network edge, and the flaw needs nothing but reachability to the API. An organisation that patched in June is fine. An organisation that has been treating this as a scheduled item now has a gap between the PoC and its own patch date during which a working, public exploit was being fired at exposed instances.
Detection remains network-side rather than host-side, because the appliance does not normally surface process telemetry to defenders: in reverse-proxy or web-application-firewall logs in front of the management API, unauthenticated POST requests to the /accessv2 endpoint carrying malformed or oversized parameters, and repeated probing of that endpoint from related sources in a short window, are the observable shape (watchTowr Labs, 2026-06-29). Triage: legitimate LoadMaster API clients authenticate and send well-formed payloads from a small, stable set of management sources — the discriminators are an unauthenticated request reaching /accessv2 at all, and parameter content that is malformed rather than merely unexpected. Hardening is unchanged and still the strongest control available: disable the LoadMaster API where it is not required, which removes the endpoint entirely, and keep the management interface off any general-purpose network.
based on evidence of active exploitation.
Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.
Kemp LoadMaster: GA v7.2.63.1 and older
Defender actions
- Re-verify every Kemp LoadMaster is on GA 7.2.63.2 or the corresponding LTSF fixed build from Progress's June bulletin and, for any appliance that was internet-reachable with the API enabled before it was patched, run a compromise assessment of the appliance rather than closing the ticket on the version string.
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Execution TA0002
T1059Command and Scripting Interpreter
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.
Update chain
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.