Progress Kemp LoadMaster command injection flaw added to KEV after active exploitation

CISA added a critical Progress Kemp LoadMaster flaw to its Known Exploited Vulnerabilities catalog after reports of active exploitation. Tracked as CVE-2026-8037 and scored 9.6, it is a command injection bug that lets an unauthenticated attacker run arbitrary commands on the load balancer appliance through unsanitized input in several command endpoints. watchTowr traced it to improper handling of user input in a quote-escaping function. Telemetry recorded 792 exploitation attempts over 41 days from 65 addresses across 18 countries, with activity as recent as early August. Federal agencies were directed to patch by August 10, a useful signal of urgency for everyone else.

Check

Patch Progress Kemp LoadMaster appliances to the fixed release now, and because the appliance sits inline with traffic, review it for signs of command execution and unexpected configuration changes.

Affected

Organizations running unpatched Progress Kemp LoadMaster (CVE-2026-8037); an unauthenticated attacker can execute arbitrary commands on an appliance that sits inline with network traffic, and exploitation is ongoing.

Fix

Apply the vendor patch, restrict management access to the appliance, hunt for unauthorized commands and configuration changes, and rotate any credentials the load balancer stored or handled.