Kemp LoadMaster CVE-2026-8037 enters KEV: pre-auth RCE at the network edge

CISA added CVE-2026-8037 in Progress Kemp LoadMaster to its Known Exploited Vulnerabilities catalogue on August 7. The flaw allowed an unauthenticated attacker to execute system commands on an ADC appliance through vulnerable command endpoints. Because LoadMaster commonly terminates TLS and sits in front of applications, compromise may expose routing configuration, certificates, sessions and internal services that are not directly reachable from the internet.

This is a case where priority should not come from CVSS alone. A technical root-cause analysis, public proof of concept and KEV listing together mean that running versions and signs of intrusion should be checked before the ordinary change cycle is allowed to finish.

How a memory bug became command injection

watchTowr researchers compared the vulnerable and corrected releases. The escape_quotes() function allocated a buffer with malloc(), so new memory retained previous heap content. More importantly, the transformed input was not reliably followed by a \0 terminator.

C code then treated the buffer as a NUL-terminated string. Reading continued beyond its logical length until a coincidental zero was encountered. An attacker could influence heap layout and bytes that were later composed into a system command. This turned an apparent memory-initialisation defect into a pre-authentication command-injection path.

The patch changed malloc() to calloc(), zero-filling the buffer, and explicitly added the terminator. The watchTowr analysis explains why both changes mattered. Progress also describes command injection in the cipher-set UI and API command.

Versions and practical exposure

The NVD entry for CVE-2026-8037 identifies releases earlier than LTSF 7.2.54.18 and the GA branch from 7.2.55.0 up to, but excluding, 7.2.63.2. Progress release notes confirm the fix in 7.2.54.18; the GA counterpart is 7.2.63.2.

The affected UI or API path has to be reachable. However, “the panel is not public” must be verified externally for every VIP, management address, NAT rule, administrator VPN and cloud interface. A load balancer can have several network planes.

The CISA KEV catalogue set an August 10 deadline for organisations subject to the relevant US directives. External telemetry described hundreds of attempts, but that count comes from monitoring organisations, not the CISA catalogue itself. A KEV entry confirms exploitation, not the number of successful compromises.

Triage and remediation

1. Inventory physical, virtual and cloud LoadMaster instances together with management/API interfaces and the running version.
2. Restrict management and API access to a dedicated administrative network. Do not treat that control as a substitute for patching.
3. Upgrade LTSF to 7.2.54.18 or GA to 7.2.63.2, or a later supported release, and verify the version after restart.
4. Preserve logs before rebuilding. Hunt for unusual cipher-set API and UI requests, new users, configuration changes, unexpected processes and outbound connections.
5. Compare appliance configuration with the last trusted backup and investigate every export made after the first suspicious event.
6. If RCE indicators exist, do not rely on “cleaning” the appliance. Rebuild from a trusted image and import a verified configuration.
7. Rotate TLS private keys, administrator passwords, API tokens and backend secrets available to the appliance. Reissuing a public certificate without generating a new private key is insufficient.
8. Investigate systems behind the load balancer for connections originating from its trusted addresses. A compromised edge device may have become a pivot.

Facts and Breachroad analysis

Progress confirms the command injection and fixed releases; CISA confirms exploitation through the KEV listing; watchTowr documents the patch analysis and RCE path. Public attempts do not establish compromise of a particular appliance. Rotating keys and investigating internal systems are Breachroad conclusions based on LoadMaster’s privileges and network position.

Technical training for administrators and SOC teams helps responders triage edge devices under time pressure. An infrastructure security assessment can verify interface exposure, segmentation and the ability to rebuild an appliance from a trusted source.