Breaking: Progress LoadMaster RCE Under Mass Exploit — CISA Deadline Today

Progress LoadMaster Under Active Exploit: Unauthenticated RCE on 792 Attempts, CISA Deadline Today

A critical command injection vulnerability in Progress Kemp LoadMaster is under active exploitation in the wild, with 792 attack attempts observed from 65 unique IP addresses across 18 countries. CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalog on August 7, giving federal agencies a three-day deadline that expires today, August 10.

The Vulnerability

CVE-2026-8037 carries a CVSS score of 9.6 (NVD rates it 9.8 with a network attack vector). The flaw exists in LoadMaster's `escape_quotes()` function, which allocates an uninitialized heap buffer via `malloc()` without writing a null terminator after escaped output. This creates an out-of-bounds read from neighboring freed memory. An unauthenticated attacker can spray command injection content into adjacent memory, which is then executed via `system()` with root privileges.

The attack surface is the `accessv2` API endpoint, specifically the `apiuser` parameter. No credentials are required. The result is full remote code execution as root on the LoadMaster appliance.

Affected versions: LoadMaster GA 7.2.63.1 and older, and LoadMaster LTSF 7.2.54.17 and older. The vulnerability also affects ECS Connection Manager, Connection Manager for ObjectScale, and MOVEit WAF.

Exploitation Timeline

Progress disclosed the vulnerability on June 4 alongside CVE-2026-33691. On June 29, watchTowr Labs published a detailed technical analysis including proof-of-concept code. Exploitation attempts began immediately. eSentire reported active targeting from June 30, though initial attempts were not always successful. KEVIntel telemetry records 792 exploitation attempts over the past 41 days, with the last observed activity on August 4. Attack origin IPs include addresses in Australia, China, Indonesia, Japan, Poland, and the US.

Why This Matters Now

LoadMaster appliances sit at the network edge, typically in the DMZ, handling SSL termination and traffic distribution for critical internal services. A compromised load balancer gives the attacker a privileged position: visibility into backend traffic, potential for man-in-the-middle interception of encrypted connections, and a foothold for lateral movement into the data centre.

The three-day CISA remediation deadline (August 7 to August 10) is unusually tight, reflecting the severity and the volume of active exploitation. The 792-attempt count from 65 IPs across 18 countries indicates broad, opportunistic scanning rather than a single targeted campaign.

So What / Action

Patch immediately. If you run Progress Kemp LoadMaster, ECS Connection Manager, ObjectScale Connection Manager, or MOVEit WAF, this is not a "next patch cycle" item. The CISA deadline is today for a reason.

If patching is not immediately possible, isolate LoadMaster management interfaces from the internet. The exploit is unauthenticated and targets the API directly. Restrict access to the management plane to trusted networks only.

Assume compromise for any unpatched LoadMaster exposed since June 29. The attack is remote, unauthenticated, and grants root. If you cannot confirm patching, treat the device as compromised and conduct forensic review: check for unexpected processes, modified system files, and outbound connections from the appliance.

Review downstream exposure. A compromised load balancer can intercept and redirect traffic to any service behind it. Map which applications and services were behind each LoadMaster instance and assess the blast radius.

Sources: CISA KEV Catalog, watchTowr Labs, eSentire, KEVIntel, SecurityWeek, Progress Software Advisory