Progress Kemp Load Master Pre-Auth RCE Flaw Faces Active Exploitation Attempts

Summary: eSentire's Threat Response Unit reported active exploitation attempts against CVE-2026-8037, a CVSS 9.6 OS command injection flaw in Progress Kemp LoadMaster that began on June 29, 2026. watchTowr Labs traced the flaw to an escape_quotes() function that failed to null-terminate sanitized strings, causing an out-of-bounds heap read that lets unauthenticated attackers inject commands through the /accessv2 endpoint.
What's compelling: eSentire said the attempts it observed failed, but a public proof-of-concept exploit and detailed technical write-ups are now available, and this is the second LoadMaster command injection flaw to see exploitation after CVE-2024-1212 at CVSS 10.0.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2024-1212 CVE-2026-8037
Related: Progress Kemp Load Master Flaw Could Let Attackers Run Root Commands Pre-Auth Cyber Risks ·
CVE-2026-8037: Progress Load Master Command Injection Vulnerability Known Exploited Vulnerabilities · Aug 07, 2026
CVE-2024-1212: Progress Kemp Load Master OS Command Injection Vulnerability Known Exploited Vulnerabilities · Nov 18, 2024