CISA Adds Critical Progress Kemp LoadMaster Vulnerability to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical vulnerability in the Progress Kemp LoadMaster load balancer to its Known Exploited Vulnerabilities (KEV) catalog. The move was prompted by reports of active attacks in the wild.

About the vulnerability

The flaw has been assigned the identifier CVE-2026-8037 and a score of 9.6 out of 10 on the CVSS scale. It is a command injection vulnerability: an unauthenticated attacker can execute arbitrary commands on the device by exploiting unsanitized user input across several command endpoints. A successful attack requires no valid credentials whatsoever.

In an analysis published in June 2026, researchers at watchTowr Labs noted that the problem lies in a function with a telling name — escape_quotes(), the very one that was meant to escape quotation marks but in practice opened the door to command injection. The cause was improper handling of user-supplied input.

The scale of the attacks

About a month before the vulnerability was added to the catalog, eSentire reported that it was observing exploitation attempts, though it noted that they were for the most part unsuccessful. According to the Canadian vendor, the attacks originated from the addresses 192.42.116.58, 192.42.116.105, and 146.70.139.154.

Telemetry from the KEVIntel service paints a broader picture: over 41 days, 792 exploitation attempts were recorded from 65 unique IP addresses across 18 countries, including Australia, China, Indonesia, Japan, Poland, and the United States. The most recent activity was noted on August 4, 2026, when five attempts were registered.

Deadlines for agencies

Given the active exploitation, Federal Civilian Executive Branch (FCEB) agencies were directed to apply the necessary updates by August 10, 2026, in accordance with the binding operational directive BOD 26-04. Other organizations using LoadMaster would be wise to hurry with the patches rather than wait for one of the hundreds of attempts to succeed.

Source: The Hacker News