{"id":1551,"date":"2026-07-01T15:03:11","date_gmt":"2026-07-01T15:03:11","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1551"},"modified":"2026-07-01T15:03:11","modified_gmt":"2026-07-01T15:03:11","slug":"progress-kemp-loadmaster-pre-auth-rce-flaw-faces-active-exploitation-attempts","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1551","title":{"rendered":"Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jul 01, 2026<\/span><\/span>Vulnerability \/ Network Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A recently disclosed critical security flaw impacting Progress\u202fKemp LoadMaster is seeing active exploitation attempts, according to an advisory<\/a> from eSentire’s Threat Response Unit (TRU).<\/p>\n

The Canadian cybersecurity company said it identified exploitation attempts targeting CVE-2026-8037<\/a><\/b> (CVSS score: 9.6), an operating system (OS) command injection flaw that could be exploited to achieve arbitrary code execution on susceptible devices. The exploitation activity commenced on June 29, 2026.<\/p>\n

\u00abOS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an unauthenticated attacker with permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input,\u00bb Progress said<\/a> in an advisory for the vulnerability released early last month.<\/p>\n

In an analysis published this week, watchTowr Labs described the flaw as rooted in a function named \u00abescape_quotes()\u00bb within the load balancer application and that it stems from improper handling of user-supplied input.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The problem was that the function failed to properly null-terminate sanitized strings, thereby leading to an out-of-bounds read into adjacent heap memory. An attacker could weaponize this loophole to issue specially crafted requests to the \u00ab\/accessv2\u00bb endpoint that manipulate the heap memory to enable command injection.<\/p>\n

The impact of successful exploitation is severe, as it allows an unauthenticated attacker to run arbitrary commands on the affected appliance without having to possess valid credentials.<\/p>\n

eSentire noted that exploitation efforts it observed ended in failure, as a result of which no post-compromise activity occurred. However, the availability of a proof-of-concept (PoC) exploit and detailed technical specifics is expected to drive malicious activity against CVE-2026-8037 in the immediate future.<\/p>\n

The attack attempts originate from the following IP addresses –<\/p>\n

    \n
  • 192.42.116[.]58<\/li>\n
  • 192.42.116[.]105<\/li>\n
  • 146.70.139[.]154<\/li>\n<\/ul>\n

    CVE-2026-8037 is the second Progress Progress\u202fKemp LoadMaster flaw to witness active exploitation efforts after CVE-2024-1212 (CVSS score: 10.0), another critical OS command injection vulnerability that could be abused for arbitrary system command execution.\u00a0<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    \ue804Ravie Lakshmanan\ue802Jul 01, 2026Vulnerability \/ Network Security A recently disclosed critical security flaw impacting Progress\u202fKemp LoadMaster is seeing active exploitation attempts, according to an advisory from eSentire’s Threat Response Unit…<\/p>\n","protected":false},"author":1,"featured_media":1552,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[64,1202,65,1032,70,2250,2251,1040,1513,316],"class_list":["post-1551","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-active","tag-attempts","tag-exploitation","tag-faces","tag-flaw","tag-kemp","tag-loadmaster","tag-preauth","tag-progress","tag-rce"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1551","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1551"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1551\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/1552"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1551"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1551"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1551"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}