On August 7, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added vulnerability CVE-2026-8037 to the Known Exploited Vulnerabilities (KEV) catalog, confirming that it is being actively exploited in real-world attacks. The vulnerability affects Progress Kemp LoadMaster, a widely deployed hardware and virtual load balancer. The issue is a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands on the device. U.S. federal civilian agencies have been instructed to remediate the vulnerability by August 10, 2026, under Binding Operational Directive BOD 26-04, but the threat is relevant to all organizations using LoadMaster.
Technical details of the vulnerability
According to the CISA description, CVE-2026-8037 is a command injection vulnerability (command injection) in Progress LoadMaster. The root cause is the lack of proper sanitization of user input in several command-processing endpoints. This allows an attacker without valid credentials to inject and execute arbitrary system commands on the LoadMaster device.
Key characteristics of the vulnerability:
- Identifier: CVE-2026-8037
- Type: command injection (Command Injection)
- Authentication: not required
- Impact: execution of arbitrary commands on the device
- Exploitation status: added to the CISA KEV catalog (confirmed exploitation)
- Affected product: Progress Kemp LoadMaster
The absence of an authentication requirement makes this vulnerability particularly dangerous: load balancers are typically accessible over the network and handle incoming traffic, which broadens the attack surface. Successful exploitation allows an attacker to fully compromise the device — from intercepting and redirecting traffic to using the load balancer as an entry point into the internal infrastructure.
Observed exploitation activity
The inclusion of CVE-2026-8037 in the KEV catalog means that CISA has sufficient evidence of active exploitation of the vulnerability. According to KEVIntel telemetry data (noting that this is a single source with limited verification), 792 exploitation attempts have been recorded over the last 41 days, originating from 65 unique IP addresses across 18 countries, including Australia, China, Indonesia, Japan, Poland, and the United States. The most recent recorded activity is dated August 4, 2026.
These figures should be treated with caution—they come from a single source and have not been independently confirmed. Nevertheless, the very fact that CISA has added the vulnerability to KEV is a reliable indicator of a real threat.
Impact assessment
Progress Kemp LoadMaster is used by organizations for web application load balancing, ensuring high availability, and managing SSL termination. Compromise of such a device entails risks on several levels:
- Traffic interception: an attacker who gains control of the load balancer can intercept, modify, or redirect all traffic passing through it, including authentication data
- Lateral movement: a load balancer occupies a privileged position in the network topology and can serve as a staging ground for attacks on internal servers
- Disruption of availability: the ability to run arbitrary commands makes it possible to disable the device, leading to the unavailability of all services it supports
Organizations are at greatest risk where the LoadMaster management interface is accessible from the internet or from untrusted network segments.
Response recommendations
Given the confirmed exploitation and critical nature of the vulnerability, the following actions are recommended:
- Immediately apply the patch from Progress for CVE-2026-8037. U.S. federal agencies are required to do this by August 10, 2026 under BOD 26-04, but all organizations should treat this deadline as a guideline
- Restrict network access to LoadMaster management interfaces—they must not be accessible from the internet. Use access control lists (ACLs) and network segmentation
- Review logs of LoadMaster devices for anomalous requests to command-processing endpoints, especially those containing unusual characters or shell command constructs
- Audit all LoadMaster instances in the infrastructure—including virtual and cloud deployments that may have been forgotten or omitted from asset inventories
Organizations using Progress Kemp LoadMaster need to apply the security update for CVE-2026-8037 within hours rather than days. The vulnerability does not require authentication to exploit, is being actively used in attacks, and affects a device that occupies a critical position in the network infrastructure. At a minimum, until the patch is installed, LoadMaster management interfaces should be isolated from untrusted networks.
