en

CVE-2026-8037: Progress Kemp LoadMaster's Pre-Authentication Root Command Injection

Technical root cause and active scanning telemetry for the CVSS 9.6 pre-auth root command injection in Progress Kemp LoadMaster appliances.

James Luther

James Luther

— 2 min read
CVE-2026-8037: Progress Kemp LoadMaster's Pre-Authentication Root Command Injection
Photo by Scott Rodgerson / Unsplash
📌
Security Roundup Series: Week of August 10, 2026 • 4 min read deep dive

Sitting directly on perimeter networks across more than 100,000 organizations, Progress Kemp LoadMaster appliances are under mass exploitation attempts following the public release of a pre-authentication root command injection exploit.

🚨
Vulnerability Intelligence: CVE ID: CVE-2026-8037 (CWE-77: Command Injection) Severity & CVSS: Critical 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Exploitation Status: ⚠️ Mass Internet-Wide Scanning & Active Exploitation (Public PoC available) Mandate: CISA KEV Emergency Directive (August 2026 deadline) Fixed Versions: LoadMaster GA 7.2.63.2 / LTSF 7.2.54.18

What's Affected

Progress Kemp LoadMaster and Progress ADC application delivery controllers and load balancers. Because LoadMaster sits at critical network ingress points routing enterprise traffic, compromising an appliance gives attackers immediate visibility into internal network architectures and perimeter bypass capability.

The Vulnerability

CVE-2026-8037 is a classic command injection flaw (CWE-77) located in multiple LoadMaster administrative API endpoints. The management daemon fails to sanitize user-supplied input parameters before concatenating them into shell command invocations, executing injected commands with full root privileges without requiring prior authentication.

Attack Chain Breakdown

Following public proof-of-concept availability on June 29, telemetry from eSentire's Threat Response Unit recorded immediate scanning bursts from hundreds of unique IP addresses:

  1. Target Identification: Attackers scan Shodan/Censys for internet-exposed LoadMaster management interfaces (ports 443, 8443).
  2. Pre-Auth Payload Injection: An unauthenticated HTTP request containing shell metacharacters (e.g. ;, |, backticks) is sent to the vulnerable API command handler.
  3. Root Shell Spawn: The appliance executes the payload as root, establishing reverse shells or downloading staging scripts.
  4. Persistence & Lateral Pivot: Attackers dump memory/session caches and use the load balancer as an internal jumping-off point.

Indicators to Check For (IOCs)

🔍
Detection Checklist: Inspect LoadMaster HTTP access logs for unusual POST requests targeting API management paths originating from non-internal IPs. Audit running processes on the appliance for unexpected shell sessions (/bin/sh, /bin/bash, curl, wget). Check for newly created local administrative accounts or unauthorized SSH authorized keys.

Remediation

✅
Remediation Steps: Upgrade immediately to LoadMaster GA 7.2.63.2 or LTSF 7.2.54.18 or later. Isolate Management Interfaces: Ensure administrative ports (HTTPS/SSH) are strictly restricted to internal management subnets or behind bastion hosts and never exposed to the public internet. Perform forensic log reviews for past access before patching, as applying updates does not evict existing web shells.
🧭
More Deep Dives from this Week's Roundup: CVE-2026-68820: Windows AFD.sys Zero-Day (Lazarus) CVE-2026-72898: Metabase Unauth SQL Injection CVE-2026-20349: Cisco ASA/FTD VPN DoS Flaw Swiss BIT Breach: Federal SharePoint Intrusion ← Return to Weekly Overview: Full Roundup

Read more