CVE-2026-8037
Known exploited · CISA KEV
CVSS 9.6 CRITICAL: oS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated… EPSS 100% (100th percentile).
CISA federal remediation date Aug 10
Vulnerabilities & Exploits · Web App Attack
A LoadMaster with its API exposed can stop being a traffic manager and start being the entry point. The bug is pre-auth, so an attacker does not need valid access first; if they reach the API, they can turn the appliance that handles TLS, WAF, and routing into code execution on the edge box itself.
Progress Kemp says CVE-2026-8037 affects Kemp LoadMaster GA v7.2.63.1 and older, and LTSF v7.2.54.17 and older, when the API is enabled. watchTowr’s research on 7.2.63.1 versus 7.2.63.2 shows the break sits in quote handling in the management API, where a bad input path can corrupt memory before authentication matters.
That makes compromise of the ADC a perimeter breach, not a single-device event, because the attacker is inside the trust point that brokers application traffic for everything behind it.
2 sources · Jul 1
Known exploited · CISA KEV
CVSS 9.6 CRITICAL: oS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated… EPSS 100% (100th percentile).
CISA federal remediation date Aug 10
The Hacker News
Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts
eSentire says attacks began June 29 against a CVSS 9.6 OS command injection flaw that enables unauthenticated code execution.
originalThe Hacker News
Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth
CVE-2026-8037 in Progress Kemp LoadMaster allows pre-auth root command execution via API; patches are available and a public PoC is out.
originalwatchTowr Labs
Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)
This time, we're looking at Progress Kemp LoadMaster, a load balancer that sits at the edge of a lot of enterprise networks.
originalPart of the PlainSec briefing for 2026-06-30
Every edition of this story: Edge ADC bug lets unauth caller become the perimeter