The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are exploiting a critical-severity Progress Kemp LoadMaster command injection vulnerability.

This OS command injection flaw, which has a CVSS score of 9.6, allows unauthenticated attackers to execute arbitrary commands as root on affected appliances by exploiting unsanitized input in the /accessv2 API endpoint.

Impact: Successful exploitation grants full remote code execution without credentials, posing significant risks to enterprise networks.
Affected Versions: The vulnerability impacts LoadMaster GA v7.2.63.1 and older, as well as LTSF v7.2.54.17 and older, when the API is enabled.
Mitigation: Progress Software released patches on June 4, 2026 (versions GA v7.2.63.2 and LTSF v7.2.54.18).
Federal Mandate: Under Binding Operational Directive 26-04, U.S. Federal Civilian Executive Branch (FCEB) agencies were ordered to patch the vulnerability by August 10, 2026.
Exploitation Activity: Telemetry data indicates 792 exploitation attempts from 65 unique IP addresses across 18 countries were recorded over a 41-day period prior to CISA's addition of the flaw to the KEV catalog.

Critical Progress LoadMaster flaw now actively exploited in attacks

By Sergiu Gatlan

Kemp LoadMaster is a very popular Application Delivery Controller (ADC) and server load balancer used by tech companies and government entities worldwide (e.g., Amazon, U.S. Air Force) to distribute incoming web traffic across multiple servers, optimize app performance, and ensure high service availability.

Progress Software says that 80% of Fortune 500 companies use its products and services, with Kemp LoadMaster having over 100,000 deployments worldwide.

Tracked as CVE-2026-8037, this critical command injection security flaw enables unauthenticated attackers to execute arbitrary commands on unpatched LoadMaster appliances by exploiting unsanitized API inputs in multiple command endpoints.

In June, Progress Software released security updates to patch the vulnerability in Kemp LoadMaster (GA v7.2.63.1 or older and LTSF v7.2.54.17 or older), and it also confirmed that it impacts all MOVEit WAF (Web Application Firewall) versions before GA v7.2.63.2.

According to Internet threat watchdog Shadowserver, nearly 300 Kemp LoadMaster instances are exposed online. However, there is no information regarding how many of them are honeypots or have already been secured against CVE-2026-8037 attacks.

On Friday, CISA added the flaw to its catalog of actively exploited vulnerabilities, ordering U.S. Federal Civilian Executive Branch (FCEB) agencies to secure their servers within three days as mandated by Binding Operational Directive 26-04.

"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," the cybersecurity agency warned.

While BOD 26-04 applies only to U.S. government agencies, CISA urged all defenders to prioritize patching the CVE-2026-8037 vulnerability to block incoming attacks.

Last month, Progress also emailed ShareFile customers who were using Storage Zone Controllers to immediately shut down servers after identifying what it described at the time as a "credible external security threat" targeting the on-premises secure file-sharing software.

Days later, the company released security patches for a high-severity ShareFile path traversal zero-day vulnerability, but told BleepingComputer that it had "no indication of unauthorized access to any ShareFile customer account or data, and we have not identified any active threat."