CVE-2026-8037

What is Progress Kemp LoadMaster?

LoadMaster is Progress Software's application delivery controller — a load balancer that also terminates TLS, performs health checking, and in many deployments acts as a web application firewall and authentication gateway. It ships as a virtual or hardware appliance and sits directly in the path of the traffic it balances.

Two things make it a high-value target. First, it terminates TLS, so it holds private keys and sees plaintext for every application behind it. Second, it is a network chokepoint: root on the appliance means the ability to intercept, redirect, or modify traffic destined for the backend pool. Progress also embeds LoadMaster inside other products, which widens the affected surface beyond customers who think of themselves as LoadMaster users.

Overview

CVE-2026-8037 is a pre-authentication command injection in the LoadMaster management API that yields command execution as root, scored CVSS 9.6.

The interesting part is that it is not a straightforward string-concatenation injection. The vulnerable function is the one meant to prevent injection — a quote-escaping routine with two memory bugs that let an attacker read attacker-controlled bytes out of adjacent heap memory into a string that is then handed to system().

Progress published its bulletin on 2026-06-04. watchTowr Labs published a full reverse-engineered analysis on 2026-06-29, and exploitation attempts began the same day. CISA added the CVE on 2026-08-07 with a BOD 26-04 deadline of 2026-08-10.

Precondition: the LoadMaster API must be enabled. It is the sole attack surface for this bug.

Affected Versions

The GA fixed build (7.2.63.2) is confirmed directly by watchTowr's analysis; the LTSF build number appears in secondary reporting. Check the Progress bulletin for your specific branch before planning the maintenance window.

Technical Details

Entry point. POST /accessv2 on the LoadMaster API, with the apiuser and apipass parameters in the JSON body.

The vulnerable function. escape_quotes() inside the access binary, reached from the authentication validation routine at 0x43B080. Its job is to escape single quotes in credentials before they are interpolated into a shell command. It contains two bugs that compound:

1. Uninitialized heap allocation. The output buffer is allocated with malloc(3 * (strlen(input) + 1) + 29) and never zeroed. It therefore inherits whatever bytes the allocator left behind in previously freed chunks.
2. Missing null terminator. The escaped output is never NUL-terminated. The later __sprintf_chk() that reads it runs off the end of the intended buffer and continues into adjacent heap memory until it happens to find a zero byte.

Exploitation. The escape expansion is the primitive. Four single quotes ('''') expand to sixteen bytes ('\'''\'''\'''\''), enough to overrun the allocation and overwrite the neighbouring freed chunk's allocator metadata — its next pointer and key. The attacker sprays additional JSON keys in the same request body to place command payloads into nearby heap chunks. When one of those payloads lands adjacent to the apiuser buffer, the unterminated read walks straight into it.

The sink. The resulting string is interpolated into system("validuser -b %s -u '%s' -p '%s'") and executed as root on the appliance.

The patch is exactly what you would expect: malloc() becomes calloc() to zero-initialize, plus an explicit *end = 0 to terminate the escaped string.

Attack characteristics. Pre-authentication, no user interaction, a single HTTP request (the heap spray rides in the same JSON body). Because it depends on heap grooming, exploitation is probabilistic rather than deterministic — which matches eSentire's observation that most real-world attempts failed.

A note on the CVSS vector. NVD scores this AV:Adjacent with Scope:Changed, reflecting an assumption that the management API sits on an isolated management network. watchTowr states plainly that no adjacent network position is technically required — anyone who can reach the API endpoint can attempt exploitation. If your management interface is reachable from a general-purpose network or the internet, treat this as a network-vector bug, not an adjacent one. The Scope:Changed rating reflects that root on the appliance pivots into the load-balanced traffic path.

Discovery

Reported by Syed Ibrahim Ahmed of TrendAI Research through the Trend Micro Zero Day Initiative, tracked as ZDI-26-342. Progress published its bulletin on 2026-06-04.

Not a zero-day. The exploitation timeline is instead a clean illustration of the disclosure-to-attack window: watchTowr's technical write-up appeared on 2026-06-29 with a functional exploitation path, and attacks started the same day.

Exploitation Context

eSentire's Threat Response Unit observed exploitation attempts beginning 2026-06-29, the day the technical analysis dropped. Source addresses included 192.42.116.58, 192.42.116.105, and 146.70.139.154 — the first two being Tor exit infrastructure. eSentire assessed the attempts as largely unsuccessful, with no post-compromise activity recorded, which is consistent with the probabilistic heap grooming the exploit requires.

KEVIntel telemetry recorded 792 exploitation attempts over 41 days from 65 unique IP addresses across 18 countries, including Australia, China, Indonesia, Japan, Poland, and the United States, with the most recent attempt on 2026-08-04. That is opportunistic mass scanning, not targeted operations.

No threat actor attribution has been published. One low-quality aggregator claimed ransomware deployment and lateral movement following exploitation; this is not corroborated by eSentire, watchTowr, or Progress, and should be disregarded. No Shodan or Censys exposure counts have been published.

The low success rate is a reason to patch calmly rather than a reason to relax. Heap grooming reliability improves with iteration, and 792 attempts against a probabilistic exploit means someone is willing to keep trying.

Remediation

1. Upgrade to LoadMaster GA 7.2.63.2 or LTSF 7.2.54.18. If you run ECS Connection Manager, Object Scale Connection Manager, or MOVEit WAF, check the Progress bulletin — these embed LoadMaster and are separately affected.
2. Disable the LoadMaster API if you do not use it. This removes the attack surface entirely and is the strongest interim mitigation available.
3. If the API is required, restrict it to a dedicated management network and an explicit allowlist of trusted source addresses. Do not expose /accessv2 to general-purpose networks or the internet.
4. Review logs for POST /accessv2 requests containing repeated single-quote sequences, unusually large JSON bodies, or unexpected numbers of JSON keys. Check specifically for traffic from the eSentire-published addresses (192.42.116.58, 192.42.116.105, 146.70.139.154) since late June 2026.
5. Inspect the appliance for compromise — unexpected root-owned processes, modified configuration, new user accounts, altered SSL/TLS certificate configuration, and unexplained outbound connections.
6. Rotate TLS private keys and any credentials the appliance holds if there is any indication of successful exploitation. An ADC compromise is a traffic-interception compromise; assume everything it terminated was visible.