CISA Adds Critical Kemp LoadMaster Command Injection Flaw to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical-severity command injection vulnerability in Progress Kemp LoadMaster to its Known Exploited Vulnerabilities (KEV) catalog, following widespread reports of in-the-wild exploitation. Tracked as CVE-2026-8037 with a CVSS score of 9.6, the flaw resides in the LoadMaster load balancer appliance and allows unauthenticated remote attackers to execute arbitrary commands on vulnerable systems. According to CISA, the vulnerability stems from improper sanitization of user-supplied input across multiple command endpoints, enabling attackers to inject and run arbitrary OS commands without valid credentials.

Security researchers at watchTowr Labs originally analyzed the flaw in June 2026, identifying the root cause in a function called "escape_quotes()" that failed to properly handle user input before passing it to system-level execution. Exploitation attempts have since been observed originating from IP addresses including 192.42.116[.]58, 192.42.116[.]105, and 146.70.139[.]154, according to eSentire. Telemetry from KEVIntel recorded 792 exploitation attempts over 41 days from 65 unique IP addresses spanning 18 countries, including Australia, China, Indonesia, Japan, Poland, and the United States. Security teams investigating suspicious traffic should verify source origins using a WHOIS lookup to identify whether inbound requests trace back to known malicious infrastructure.

Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies have been ordered to apply patches by August 10, 2026. Network defenders should also audit exposed LoadMaster appliances using a port scanner to identify internet-facing instances and ensure mitigations are deployed. Organizations running affected versions should prioritize patching immediately, as unauthenticated remote code execution on network infrastructure devices poses severe risk of lateral movement and persistent network compromise.