Feds Must Patch Progress LoadMaster by Today as Hackers Log 792 Exploit Attempts Against the Edge Appliance
US agencies have until the end of Monday, August 10, to close a critical hole in Progress Kemp LoadMaster, a network appliance that sits in front of thousands of corporate applications. CISA added the flaw, tracked as CVE-2026-8037, to its Known Exploited Vulnerabilities catalog on August 7, after a summer of failed but persistent attempts to break into the load balancer from 18 countries.
The bug is a command injection in the LoadMaster API. An attacker who can reach the management interface — no username, no password, nothing — can run arbitrary operating-system commands as root on the appliance. CISA scores it 9.6 out of 10; the Zero Day Initiative, which coordinated the disclosure, rated it 9.8.
"Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints," the agency wrote in its catalog entry.
What the attack looks like
LoadMaster is an application delivery controller, the box that balances traffic across a company's web servers and often terminates TLS before requests reach the backend. It sits at the network edge by design, which is exactly why a pre-auth bug in it is so dangerous.
The root cause is a helper function named escape_quotes(), which is supposed to scrub user input before it becomes part of a shell command. Its job is to escape single quotes so nobody can break out of a quoted string and inject their own commands.
It fails that job. As watchTowr Labs documented in its June 29 technical write-up, the function allocated a memory buffer without initializing it and never wrote a null terminator at the end of the sanitized string. Without that terminator, the system keeps reading past the end of the sanitized input into whatever happens to sit next to it in memory. An attacker controls what sits there by packing extra JSON key-value pairs into the same API request, each one carrying a command-injection payload. The system reads the sanitized input, runs past its boundary, hits the payload, and executes it as root.
The attack targets the /accessv2 endpoint, which handles API credential validation. The request is a JSON body with a crafted apiuser value plus dozens of extra keys carrying the command to run. No valid credentials are required.
Security researcher Syed Ibrahim Ahmed of TrendAI Research found the bug and reported it through ZDI on April 15. Progress published its advisory on June 4 and shipped a fix. The patch itself is almost absurdly small for a flaw this serious: the memory allocation was swapped to a zero-filling variant and an explicit null terminator was added after the escaped output. Two lines of code that close a path to root.
watchTowr Labs then analyzed the patch diff, rebuilt the vulnerable code path, and published a working proof of concept on June 29. That same day, eSentire's Threat Response Unit started seeing exploitation attempts in the wild.
Exploitation is real, even if most of it fails
eSentire, a Canadian managed detection and response firm, says activity began on June 29 — the same day the PoC went public — and came from three IP addresses it listed in its advisory: 192.42.116.58, 192.42.116.105 and 146.70.139.154. The Canadian vendor noted the attempts it observed were largely unsuccessful and it detected no post-compromise activity.
The picture from telemetry is bigger. KEVIntel data logged 792 exploitation attempts over 41 days, coming from 65 unique IP addresses spread across 18 countries, including Australia, China, Indonesia, Japan, Poland and the United States. The last activity in that dataset was recorded on August 4, when five attempts were detected.
That is the pattern CISA worries about most: a critical, pre-auth flaw in an edge device, with a public PoC, getting probed from botnets and scanning infrastructure for weeks. Most attempts fail. It only takes one that does not.
Administrators running affected versions should assume their appliance has been probed since late June. Do not wait for a clean telemetry report to patch.
What to patch, and how
The flaw affects LoadMaster GA v7.2.63.1 and older, and LTSF v7.2.54.17 and older, when the API is enabled. Progress has released fixed versions: GA v7.2.63.2 and LTSF v7.2.54.18.
For federal civilian agencies, the deadline is today. Under Binding Operational Directive 26-04, FCEB agencies must apply the fix by August 10, 2026, per the KEV catalog's due date for CVE-2026-8037.
Three pieces of advice for everyone else:
First, patch. The fixed builds are available from Progress's download portal, and the company's June security bulletin spells out the upgrade path for both GA and LTSF streams.
Second, ask whether the API needs to be reachable at all. LoadMaster's API is often left exposed to management networks — and sometimes to the internet — out of convenience. If the API is not needed, disable it or restrict it to trusted hosts. A pre-auth root bug is only exploitable if the endpoint is reachable.
Third, check for signs of prior intrusion. Look for unexpected processes, unusual outbound connections from the appliance, new accounts, and modified configuration files. Rotate any credentials the appliance stores — a root shell on a load balancer gives an attacker the same credentials the box uses to talk to backend services.
This is also a Moment to remember the sector's recent history. The same vendor's MOVEit file-transfer software was hit by a mass exploitation campaign in 2023 at the hands of the Cl0p ransomware gang, and CISA added an earlier LoadMaster command-injection flaw, CVE-2024-1212, to its KEV catalog back in November 2024 after confirmed in-the-wild exploitation. Progress patched five more high-severity LoadMaster issues in April 2026, four of them command injection. The current bulletin also fixed a second flaw, CVE-2026-33691, a WAF bypass that let whitespace padding in filenames slip past file-upload extension checks.
The Canadian Centre for Cyber Security followed with its own advisory urging administrators to apply the updates, a sign of how widely LoadMaster is deployed in government and private infrastructure.
Why edge appliances keep getting hit
There is a pattern here that goes beyond Progress. Our Cybersecurity coverage is full of edge appliances and management planes that became front doors for attackers: the Cisco Secure Firewall Management Center hard-coded-account issue that CISA ordered patched in late July, the TeamCity CI/CD build server RCE that hit the KEV catalog with a CVSS score of 9.8, Fortinet FortiSandbox flaws exploited in the wild, N-able N-central routers under attack after an incomplete patch. In each case the same ingredients: a network-facing device, a pre-auth or low-auth flaw, a public PoC, and a lag between disclosure and patching.
Load balancers make especially good targets. They terminate TLS, so they see decrypted traffic. They hold credentials for backend systems. They are managed by a handful of engineers rather than a dedicated security team. And they are often pinned to the "works, don't touch it" shelf for years at a time, running versions far older than the vendor's support window.
The 792 attempts logged against CVE-2026-8037 are not a curiosity. They are the baseline scan-and-pray noise that every critical, pre-auth edge flaw generates within hours of a public PoC. The organizations that get hurt are the ones with no inventory of their appliance versions, no change window, and no way to know the API was exposed in the first place.
The bottom line
Patch by end of day if you run LoadMaster. If you cannot patch immediately, restrict API access to the management network, add monitoring for the /accessv2 endpoint, and check the appliance for signs of compromise. Then build the inventory you should have had before: every appliance, every version, every exposed management interface, and a documented upgrade path. The next pre-auth root bug is already being researched somewhere, and it will not come with a 41-day warning.
For more on the broader pattern of exploited appliances, see our coverage of the CISA KEV catalog additions for Langflow, Tomcat and N-able from earlier this month.
Cyber Security News