Progress LoadMaster Hit by Critical Command Injection — 100,000 Deployments Exposed, 80% of Fortune 500 Affected
CISA added **CVE-2026-8037** to the KEV catalog on **August 7, 2026** — the command injection flaw in Progress Kemp LoadMaster is under active exploitation by ransomware gangs. Patch now before your load balancer becomes your infrastructure's front door for attackers.
August 10, 2026. The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-8037 to its Known Exploited Vulnerabilities catalog. Progress Software confirms active exploitation. Over 100,000 LoadMaster deployments are exposed. If your load balancer says Kemp on the tin, you likely have a problem already.
Progress’s Application Delivery Controller — formerly Kemp Technologies, acquired in 2021 — is an invisible pillar of enterprise internet infrastructure. It distributes traffic, terminates TLS, enforces routing rules. Amazon runs it. So does the U.S. Air Force. Progress claims 80% of Fortune 500 companies use its products, with LoadMaster exceeding 100,000 deployments worldwide.
A command injection on this link in the chain, and every service behind it is compromised.
Command injection on the admin interface
CVE-2026-8037 is a command injection vulnerability in the LoadMaster administrative interface. An unauthenticated attacker can send a specially crafted request to the web UI and execute arbitrary commands with application-level privileges — typically root on the appliance.
A CVSS score has not yet been published by NVD at the time of writing, but its inclusion in the CISA KEV catalog means one thing: threat actors are already exploiting it in the wild. Under Binding Operational Directive BOD 22-01, U.S. federal agencies must remediate within 21 days — and every other organization should follow the same timeline.
Progress released patches in July 2026, before the KEV listing. Fixed versions include LoadMaster 7.2.61.0 and later. If your appliance is still running an earlier version, every hour counts.
Why a load balancer is a prime target
An ADC like LoadMaster is not a simple traffic cop. It sits in front of every application server. It terminates TLS — meaning it sees traffic in cleartext. It applies routing rules based on HTTP headers, cookies, sometimes request body content. It handles authentication and web application firewall (WAF) policies.
For an attacker, compromising the load balancer yields three immediate benefits:
- Traffic interception: all encrypted flows pass through the ADC in cleartext. The attacker captures credentials, session tokens, business data — everything the application processes.
- Backend pivot: from the load balancer, the internal network is reachable. Application servers, databases, identity directories — all within probing distance.
- Stealthy persistence: a load balancer does not trigger EDR alerts. It’s not on the list of surfaces teams monitor first. A compromise can remain undetected for months.
Ransomware gangs have figured this out. According to CISA, groups are already exploiting the flaw to deploy ransomware after breaching the perimeter through LoadMaster. The classic playbook: compromise the ADC → lateral movement → exfiltration → encryption.
LoadMaster in Progress’s security history
Progress Software is no stranger to security teams. The vendor was at the center of the MOVEit Transfer exploitation wave in 2023, when the Cl0p ransomware group compromised thousands of organizations through a zero-day SQL injection. The incident affected the BBC, British Airways, Shell, and dozens of government agencies.
That precedent makes the LoadMaster news particularly concerning. Progress has strengthened its security processes since MOVEit, but the attack surface of its products remains vast — and attackers know that network appliances are patched less frequently than workstations.
The fact that CVE-2026-8037 was under active exploitation before its KEV listing suggests attackers are watching Progress advisories closely. As soon as a patch ships, they reverse-engineer it to find the flaw and target unpatched deployments. This patch diffing has become standard practice for network appliance vulnerabilities.
What you need to do right now
1. Check your version. Log into the LoadMaster admin interface and verify the version under System > System Administration > Update Software. If you’re below 7.2.61.0, you are vulnerable.
2. Apply the patch immediately. The LoadMaster update process is documented by Progress. Schedule a maintenance window — a reboot is required.
# Quick version check from the LoadMaster CLI
ssh [email protected] "cat /etc/progress-release"3. Isolate the admin interface. While waiting to apply the patch — or as a defense-in-depth measure — restrict access to the LoadMaster web interface to a dedicated management network. No ADC admin interface should ever be exposed to the internet.
4. Check the logs. Look for unusual connections to the admin interface, unknown account creation, or unplanned configuration changes. LoadMaster logs are available under System > Logging.
5. Scan your entire fleet. If you run LoadMaster, you likely have multiple instances — production, staging, DR. Verify every single one.
The verdict
CVE-2026-8037 is a critical flaw on a device sitting at the heart of enterprise networking. Active exploitation by ransomware gangs makes this an incident response event, not a scheduled maintenance task.
If your LoadMaster is exposed — even partially — patch today. If you discover the flaw a week from now, it will be too late: the attackers are already in the loop. And unlike MOVEit, a load balancer doesn’t just transfer files — it sees every byte of your company’s traffic.