CVE 2026 8037 Security Alert at Progress Kemp LoadMaster allows remote execution of commands without authentication and is already exploited

A new critical failure in Progress Kemp LoadMaster, identified as CVE-2026-8037 and with a CVSS score of 9.6, it is being actively attacked shortly after its disclosure: this is warned by the TRU unit of eSentire, which recorded attempts to operate from 29 June 2026. Unlike vulnerabilities that require internal credentials or accesses, this failure allows an attacker run commands on application remotely and without authentication, which raises the risk to a critical level for organisations that expose these boxes to unreliable networks.

The technical root of the problem, according to public analysis, is located in the function called "escape _ quotes ()" of the swimmer software. The error consists of an incorrect management of the user's input: the "sanitized" chain is not properly finished with null, which produces an off-limits reading in the heap and opens the door to manipulate the adjacent memory. Taking advantage of this condition, an attacker can send specially formed requests to the endpoint "/ accessv2" and turn memory corruption into a operating system command injection, with the ability to execute arbitrary instructions in the application.

The fact that the exploitation is possible without credentials makes the perimeter defenses and the visibility of public access critical. eSentire reported that the attempts he observed did not result in full commitments, but also warned that the existence of a concept test (PoC) and detailed technical descriptions increases the likelihood that the attackers will resume and automate the attacks in the next hours or days. Historically, similar vulnerabilities in LoadMaster (e.g., CVE-2024-1212) received active exploitation shortly after their disclosure, which reinforces the urgency.

IP addresses associated with detected attempts include 192.42.116.58, 192.42.116.105 and 146.70.139.154; these IoC can serve as a starting point for blocking or investigating malicious activity, although blocking PIs is only a temporary measure and does not replace definitive corrections. For technical reference and coordination with remedy teams, it is appropriate to consult the official records and vulnerability sheet in centralized sources such as the NVD vulnerability database: NVD - CVE-2026-8037 and the manufacturer's ad and patch pages in Progress Security Advisories.

For security equipment and operations, the immediate response should prioritize three complementary actions: first, to determine whether there are LoadMaster applications exposed to public networks and to plan their temporary isolation if it is not possible to apply the patch immediately. Second, apply the official update of the supplier as soon as it is available and verify the installed version before and after deployment; if the supplier recommends additional mitigation (configurations, disable endpoints, access rules) should be implemented as a matter of priority. Third, activate threat hunting focused on access to "/ accessv2," unusual commands executed by application processes, and application patterns that include typical heap injection or handling sequences.

At the operational level it is appropriate to review HTTP / HTTPS records and the application console itself in search of requests with foreign payloads, escape characters, pipes, backsticks or suspicious chains indicating injection attempts. The correlation systems and EDR should look for processes that run unexpected shell commands and unusual outgoing connections from the IP of the application. In addition, maintaining recent backup and recovery plans will help to minimize impact if an intrusion is confirmed.

For organizations with many applications deployed or with third-party units, it is critical to maintain an updated inventory and coordinate with suppliers and customers on maintenance windows. Where the patch cannot be applied immediately, the implementation of compensatory controls such as firewall rules that restrict access to the administrative port, management VPNs, and WAF filters that detect injection patterns can reduce the attack surface.

Finally, this impact highlights a recurring lesson: managed infrastructure devices (balers, firewalls, proxies) are attractive targets for attackers because a commitment offers broad levers within corporate networks. The best defense combines fast parking, network segmentation and continuous visibility. To be informed through the supplier's and security community's analysis and to prioritize response resources on critical assets will make the difference between a failed attempt and a commitment to business impact.