Critical Vulnerability in Progress LoadMaster allows execution of commands like root without authentication (CVE-2026-8037)

Progress Kemp LoadMaster has a critical vulnerability that allows an unauthenticated attacker to execute arbitrary commands like root sending a specially built request to your API; the failure appears as CVE-2026-8037 and received a high CVSS score (9.8) according to Zero Day Initiative. Progress published a security notice in early June and there are already parcheed versions; however, the existence of a public concept test and the fact that the device acts as a network edge make this problem a priority for any organization that uses LoadMaster with the enabled API.

The technical origin of the failure is amazingly simple and enlightening from the point of view of safe operations: a function in charge of "escape" simple quotes before passing the entry to a shell command did not correctly initialize its buffer and did not add a zero terminator at the end of the resulting chain. This absence allows the chain reading to flow into memory and reach adjacent data controllable by the attacker; sending dozens of additional JSON keys in the same request the opponent can place there the load that will be interpreted and executed by the shell. The specific vector is the endpoint / accessv2, which validates API credentials, and does not require valid credentials to achieve the execution, which is produced with permission of root.

The affected versions are LoadMaster GA v7.2.63.1 and above, and LTSF v7.2.54.17 and above, provided the API is enabled; the corrected versions are GA v7.2.63.2 and LTSF v7.2.54.18. The patch is small and direct: change one memory assignment call to another that initializes the buffer to zero and add the null terminator to the end of the escaped chain; two lines that close the door to the operation. The discovery was reported through Zero Day Initiative and later publicly analyzed by external researchers, who demented the chain of exploitation and published a concept test, making it urgent to apply the update.

The operational implications are clear. A socket and application delivery controller located on the perimeter is a high-value objective: compromising it allows you to intercept traffic, deploy back doors, move laterally over the internal network and potentially deploy destructive or Ransomware charges easily. In addition, Progress is not alien to high-impact incidents (the MOVEit platform was massively exploited in 2023), so organizations should consider both probability and impact on their mitigation strategies.

If your environment uses LoadMaster with the enabled API, the priority actions that should be implemented immediately are to patch to the corrected versions and assess whether the API needs to be exposed. If you cannot apply the patch immediately, mitigate reducing the attack surface: disable the API if not necessary, restrict access to endpoint from reliable management networks, implement firewall rules and network-level access control lists to limit who can communicate with the device, and use segmentation to prevent a committed machine from reaching critical systems. After updating, check the installed version and check signatures or checks of the binaries if Progress provides them.

It's not enough to just park. Perform active searches of possible signs of engagement: inspect access and system records at critical times, search for unusual root-executed processes or commands, new crontabs or user accounts, suspicious outgoing traffic and changes in application settings. Isolate any instances with anomalies and preserve evidence for forensic analysis. Consider also rotating credentials and certificates that the swimmer manages or stores, in case the previous operation had compromised sensitive material.

Finally, reflect on the need for the API to be accessible from uncontrolled networks: if the API does not need to be publicly exposed, it should not be. Audit services on the perimeter, apply the principle of minor privilege and maintain an agile patch program. For more information on outreach coordination and catalogues of exploited vulnerabilities, see the Zero Day Initiative and the catalogue of known vulnerabilities exploited by real CISA actors: ZDI advisories and CISA Known Exploited Vulnerabilities catalogue. The supplier's recommendations and progress official security notices are available on your security portal: Progress Security. Check now and then seriously ask yourself whether the API should remain accessible from networks that it does not control.