CISA has added CVE-2026-8037, a command injection vulnerability in Progress Kemp LoadMaster exploited in the wild, to the Known Exploited Vulnerabilities catalog. Third-party telemetry has documented 792 exploitation attempts against the network edge appliance, which sits at the perimeter of internal networks and sees traffic to critical services, making it a favored initial-access target.
The Command Injection Chain Behind CVE-2026-8037
The flaw, rated CVSS 9.6, allows an unauthenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input across multiple command endpoints, according to CISA. Progress traced the issue to handling of the apiuser parameter provided to the accessv2 endpoint, while ZDI described a lack of proper memory initialization before access that permits code execution in the context of root.
watchTowr’s escape_quotes() Analysis and Unsafe Memory Handling
Security firm watchTowr attributed the root cause to the escape_quotes() function in LoadMaster GA 7.2.63.1 and older and LTSF 7.2.54.17 and older releases. The function allocates an uninitialized heap buffer without a null terminator, leading to out-of-bounds reads and command injection into adjacent memory that is ultimately executed via system(). The result is unauthenticated code execution on a device with privileged network position.
From PoC Publication to In-the-Wild Exploitation
Exploitation in the wild began around June 30, immediately after watchTowr published technical analysis and a proof-of-concept. eSentire reported observing the initial exploitation attempts and assessing most of them as largely unsuccessful, but the volume of follow-on activity recorded since then has kept the flaw in the exploited category.
792 Exploitation Attempts and the Scale of the Campaign
KEVIntel telemetry tracked 792 exploitation attempts over 41 days, originating from 65 unique IP addresses across 18 countries, including Australia, China, Indonesia, Japan, Poland, and the United States. The most recent documented activity recorded five attempts, according to the telemetry.
eSentire-Published Attacker Infrastructure
eSentire identified a set of attacker IPs tied to the exploitation attempts, including 192.42.116.58, 192.42.116.105, and 146.70.139.154. Organizations running LoadMaster at the network edge can use those addresses to hunt for evidence of a compromise alongside the command-execution indicators associated with the accessv2 and apiuser path.
Why a LoadMaster Compromise Matters for Network Access
LoadMaster appliances terminate and inspect traffic to internal services, which means an attacker who achieves code execution on the device gains a position through which they can observe internal traffic and pivot into the wider network. That positioning is what elevates the practical impact of the unauthenticated command execution beyond the appliance itself.
BOD 26-04 Patch Deadline and the Products Affected
Federal civil agencies face a hard remediation deadline under Binding Operational Directive 26-04, which mandates patching by August 10. CISA’s KEV addition on the preceding Friday triggers the three-day federal patch requirement, and the catalog entry carries the standard directive for agencies to apply Progress’s fix without delay.
Affected Products Beyond the Core LoadMaster Appliance
Progress’s advisory extends beyond the flagship appliance. The same vulnerability affects ECS Connection Manager, Connection Manager for ObjectScale, and the MOVEit WAF, products that share the LoadMaster codebase or deployment model. Security teams that run any of these components should treat their exposure as equivalent to that of a LoadMaster gateway.
The Rapid PoC-to-Exploitation Turnaround for the LoadMaster Appliance
The LoadMaster episode tracks a pattern now common in appliance security: a detailed technical write-up and working PoC lands within days of a vendor’s initial disclosure, and scanning begins almost immediately after. For software that brokers access at the network perimeter, the window between public technical detail and observed exploitation is narrow enough that patch programs built around quarterly or even monthly cadences will frequently lag an active campaign. The 792 distributed attempts across 18 countries indicate a broad, low-friction scanning effort rather than a single coordinated operation, which is precisely the shape of activity that defenders cannot afford to wait out.
