{"id":2294,"date":"2026-08-08T12:40:11","date_gmt":"2026-08-08T12:40:11","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2294"},"modified":"2026-08-08T12:40:11","modified_gmt":"2026-08-08T12:40:11","slug":"progress-kemp-loadmaster-flaw-hits-cisa-kev-after-792-reported-exploit-attempts","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2294","title":{"rendered":"Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Aug 08, 2026<\/span><\/span>Vulnerability \/ Network Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added<\/a> a critical-severity security flaw impacting Progress\u202fKemp LoadMaster to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild.<\/p>\n

The vulnerability, tracked as CVE-2026-8037<\/strong> (CVSS score: 9.6), is a command injection flaw that could be weaponized to achieve arbitrary code execution on susceptible devices.<\/p>\n

\u00abProgress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints,\u00bb CISA said<\/a>.<\/p>\n

In an analysis published in June 2026, watchTowr Labs described the issue as present in a function named \u00abescape_quotes()\u00bb within the load balancer application and that it stemmed from improper handling of user-supplied input, ultimately enabling command injection.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Successful exploitation of the flaw can allow an unauthenticated attacker to run arbitrary commands on the affected appliance without having to possess valid credentials.<\/p>\n

The addition comes a little over a month after eSentire said it’s seeing active exploitation efforts targeting the flaw, although it noted those efforts were largely unsuccessful.<\/p>\n

\"\"<\/a><\/div>\n

The attacks originated from the following IP addresses, per the Canadian security vendor –<\/p>\n