CISA has confirmed active exploitation of a critical flaw in Progress Kemp LoadMaster, the load-balancing appliance many businesses put in front of their websites, apps, and internal systems to spread traffic and keep services online. Tracked as CVE-2026-8037 and rated 9.6 out of 10 on the CVSS scale, the bug lets an attacker run commands on an unpatched LoadMaster with no login at all. The root cause sits in how the appliance's management API sanitises input: a function meant to escape special characters instead read past the end of an uninitialised memory buffer, and researchers at watchtowr Labs showed that carefully crafted input in that gap gets passed straight into a system-level command, handing the attacker a root shell.
Progress disclosed the flaw and shipped fixed versions — LoadMaster GA 7.2.63.2 and LTSF 7.2.54.18 — on the same day, 4 June. Working exploit code became public three weeks later, and BleepingComputer reports exploitation attempts began within days of that release. CISA added the bug to its Known Exploited Vulnerabilities catalog on 7 August after logging 792 exploit attempts from 65 IP addresses, and set a remediation deadline of 10 August for U.S. federal agencies under its newest binding directive. Two months separate the patch from CISA's KEV listing — a long window in which any exposed, unpatched LoadMaster was a standing target.
What this means for your business
A load balancer usually sits at the very edge of your network, in front of the systems it's meant to protect — which is exactly why a pre-auth flaw here is worse than the same bug buried deeper inside. If your business, or an IT provider acting on your behalf, runs Kemp or Progress LoadMaster in any form (physical appliance, virtual machine, or cloud image), check the version today and upgrade to 7.2.63.2 (or LTSF 7.2.54.18) if it isn't already current — the patch has been available since June, so this is a known gap to close, not a wait-and-see situation. While you're at it, confirm the appliance's management interface isn't reachable from the open internet; it should sit behind a firewall or VPN, reachable only from IPs that need it, regardless of whether this particular flaw is patched. If patching happened late, it's worth a quick look through recent admin logs for command activity you don't recognise. More broadly: internet-facing network appliances — load balancers, VPN gateways, firewalls — are increasingly the first thing attackers probe, precisely because they sit outside the software most businesses think to patch quickly. They deserve the same update discipline as your website or CMS.