CVE-2026-8037: Progress Kemp LoadMaster Unauthenticated OS Command Injection RCE

CVE-2026-8037 is an unauthenticated OS command injection vulnerability in the API of Progress Kemp LoadMaster that lets a remote attacker with no credentials execute arbitrary commands on the LoadMaster application-delivery-controller appliance by sending unsanitized input to multiple command endpoints, and CISA added it to the Known Exploited Vulnerabilities catalog within days of disclosure.

CVE-2026-8037 is an OS command injection vulnerability (CWE-77) in Progress Kemp LoadMaster, a hardware/virtual application delivery controller (load balancer) widely deployed at the network edge. NVD's description states: "OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints" (NVD).

NVD's own analysis gives CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction, full compromise of confidentiality, integrity and availability. Progress's own CNA submission scores it lower under CVSS v4.0 (8.8), but NVD's Primary v3.1 score is 9.8 (NVD).

Progress's "LoadMaster Critical Security Bulletin" (June 2026, covering CVE-2026-8037 and the related CVE-2026-33691) states the flaw affects "Kemp LoadMaster: GA v7.2.63.1 and older" and "Kemp LoadMaster: LTSF v7.2.54.17 and older," fixed in "Progress Kemp LoadMaster GA v7.2.63.2" and "LTSF v7.2.54.18" respectively. The bulletin recommends a firmware upgrade to the latest version and does not describe a workaround; it also states Progress had "not received any reports that this vulnerability has been exploited" at publication time, with "no known indicators of compromise" (Progress LoadMaster Critical Security Bulletin).

Despite that initial "no known exploitation" statement, CISA added CVE-2026-8037 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-07 (catalog version 2026.10.28, 1762 entries, confirmed live this run) with an unusually short required-action due date of 2026-08-10 and a forensic-triage requirement under BOD 26-04 — both signals CISA treats unauthenticated-RCE on internet-facing load-balancer appliances as high-urgency regardless of a vendor's initial exploitation assessment. The catalog does not record known ransomware-campaign use (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.9984 (99.961st percentile) — among the highest EPSS scores observed, consistent with active scanning and exploitation of an unauthenticated, internet-facing RCE on a widely deployed edge appliance (FIRST EPSS).

Because the only remediation is a firmware upgrade, any LoadMaster GA build at or below 7.2.63.1, or LTSF build at or below 7.2.54.17, should be upgraded to 7.2.63.2 / 7.2.54.18 immediately and checked for signs of prior compromise given the very high EPSS score and KEV listing.

• Unauthenticated OS command injection in the LoadMaster API allows a remote attacker to execute arbitrary commands via unsanitized input in multiple command endpoints. — NVD
• NVD Primary CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; Progress's own CVSS v4.0 CNA submission is 8.8. — NVD
• Affects Kemp LoadMaster GA through 7.2.63.1 (fixed in 7.2.63.2) and LTSF through 7.2.54.17 (fixed in 7.2.54.18); firmware upgrade is the only remediation; no confirmed exploitation reports at the bulletin's publication. — Progress LoadMaster Critical Security Bulletin
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-07, required-action due date 2026-08-10, forensic-triage required under BOD 26-04 (catalog version 2026.10.28, 1762 entries, confirmed live this run). — CISA KEV
• EPSS score is 0.9984 (99.961st percentile) as of 2026-10-28. — FIRST EPSS