CISA: Progress LoadMaster RCE Is Exploited in Attacks

CISA has added CVE-2026-8037 in Progress Kemp LoadMaster to its Known Exploited Vulnerabilities catalog after confirming exploitation in the wild. The flaw is an unauthenticated command injection in the appliance API. A reachable attacker can execute arbitrary operating-system commands on an edge device that often terminates TLS and directs traffic to critical applications.

CISA added the vulnerability on August 7 and set August 10 as the remediation deadline for covered federal systems under its current risk-based directive. That unusually short window reflects more than a high severity score: public exploit research exists, multiple telemetry sources have recorded attempts, and successful exploitation reaches a high-value network control point.

Why CVE-2026-8037 is critical

Progress rates the issue CVSS 9.6; NVD's independent assessment is 9.8. Both agree on the essential risk: no account and no user interaction are required. The vulnerable cipher-set UI and API command failed to neutralize attacker-controlled input before it reached the operating system.

watchTowr's technical analysis traced the behavior to input handling around the LoadMaster API and demonstrated pre-authentication command execution. Because the appliance runs privileged services, the resulting command path can operate as root. The API must be reachable for remote exploitation, but “internal only” is not a remediation when an attacker already has access to a partner network, VPN or compromised endpoint on the same management segment.

Affected and fixed LoadMaster versions

GA 7.2.63.1 and earlier are affected; update to at least 7.2.63.2.
LTSF 7.2.54.17 and earlier are affected; update to at least 7.2.54.18.

Progress has since published newer maintenance releases. Operators should follow the supported upgrade path and install the latest appropriate GA or LTSF build, rather than stopping at the first version that contains the fix. Other Progress ADC products appear in the broader CVE record, so teams should use the vendor bulletin to map every deployed product and release line.

Patch first, then assume the appliance may have been reached

An edge appliance is not a normal application server. It holds certificates, knows backend addresses, observes authentication flows and often has privileged network reachability. Replacing the vulnerable firmware prevents a new request from using the same bug; it does not invalidate credentials, delete persistence or explain commands that may already have run.

CISA's KEV status establishes that exploitation exists, but it does not publish a universal indicator proving compromise. Scanner traffic and successful command execution are also different events. Defenders need appliance, reverse-proxy and surrounding network evidence to decide which one occurred in their environment.

Incident-response checklist

Find every instance. Include virtual appliances, disaster- recovery nodes, lab systems and management interfaces reachable through VPNs.
Update immediately. Move GA and LTSF systems beyond the fixed versions, following Progress's supported upgrade sequence.
Reduce API exposure. Restrict management and API access to dedicated administrator networks and approved jump hosts.
Preserve evidence. Export available system, API, audit and network logs before reimaging or replacing a suspected appliance.
Hunt around the edge. Review unusual child processes, outbound connections, configuration changes, new users, modified startup behavior and access to backend services.
Rotate exposed trust material. Replace administrative secrets, API credentials and private keys if evidence suggests command execution or if their confidentiality cannot be established.
Validate from a clean system. Confirm the installed build and management-plane ACLs after remediation, then retest external and internal reachability.

The weekend signal is exploitation, not publication date

Progress shipped fixes in June and researchers published the exploit chain later that month. The new development is CISA's August 7 KEV addition and August 10 deadline. This is a common vulnerability-management failure mode: a patch can exist for weeks while exposed appliances remain unchanged, until reliable exploitation turns technical debt into an incident queue.

Prioritize by evidence as well as score. An internet-reachable LoadMaster with its API enabled, an available exploit path and confirmed in-the-wild activity belongs ahead of higher-scoring issues that have no reachable attack surface.