Progress Kemp Load Master Flaw Could Let Attackers Run Root Commands Pre-Auth

Summary: A critical pre-authentication command injection flaw in Progress Kemp LoadMaster, tracked as CVE-2026-8037 with a CVSS score of 9.8, lets an unauthenticated attacker run arbitrary commands as root by sending a crafted JSON request to the /accessv2 API endpoint. The bug sits in the escape_quotes() function, which allocated an uncleared buffer and omitted a null terminator, so the system reads past the sanitized input into attacker-supplied JSON keys carrying the payload; Progress published its advisory on June 4, fixed versions are GA v7.2.63.2 and LTSF v7.2.54.18, and watchTowr Labs published a full exploit chain with a working proof of concept on June 29.
What's compelling: A public proof of concept now exists for a root-level flaw in an appliance that sits at the network edge, and LoadMaster's track record is not reassuring: a prior command injection flaw, CVE-2024-1212 at CVSS 10.0, was confirmed exploited in the wild and added to CISA's KEV catalog in November 2024.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2024-1212 CVE-2026-33691 CVE-2026-8037
Related: Progress Kemp Load Master Pre-Auth RCE Flaw Faces Active Exploitation Attempts Cyber Risks ·
CVE-2026-8037: Progress Load Master Command Injection Vulnerability Known Exploited Vulnerabilities · Aug 07, 2026
CVE-2024-1212: Progress Kemp Load Master OS Command Injection Vulnerability Known Exploited Vulnerabilities · Nov 18, 2024