Progress Kemp LoadMaster CVE-2026-8037 (CVSS 9.6) Added to CISA KEV After 792 Exploit Attempts
CISA added Progress Kemp LoadMaster's CVE-2026-8037 — a CVSS 9.6 command injection flaw — to its Known Exploited Vulnerabilities catalog after 792 documented exploit attempts. Federal agencies have until August 10 to patch. Here is how to find, fix, and verify your deployments.
Washington — CISA has placed a critical Progress Kemp LoadMaster flaw on its Known Exploited Vulnerabilities (KEV) catalog after defenders documented 792 exploit attempts against it. The vulnerability, tracked as CVE-2026-8037, is a command injection flaw that carries a CVSS score of 9.6 and can be weaponized for arbitrary command execution on the appliance.
CVE-2026-8037 is a CVSS 9.6 command injection vulnerability in Progress Kemp LoadMaster that CISA added to its KEV catalog after 792 documented exploit attempts — active exploitation preceded the listing, not the other way around. For anyone running the load balancer, that reorders the week: this is a patch-now item with a federal deadline attached, not a theoretical advisory to file for later.
What CISA Added, and When
CISA added CVE-2026-8037 to its catalog on Friday, August 7, 2026; The Hacker News reported the move the following day, noting that the 792 exploit attempts had been logged against the flaw before the listing. The KEV catalog is not a severity ranking. A vulnerability lands on it only when CISA has evidence it is being used in real attacks — a higher bar than a bad CVSS score alone — and the documented attempt volume is what pushed this one across that line. It is the latest in a run of active-exploitation entries CISA has posted this month, following a batch covering Langflow, N-central, and Tomcat.
Reporting around the listing added texture on the exploitation. The Hacker News described the 792 attempts as observed over roughly 41 days, originating from 65 unique IP addresses across 18 countries — a spread that reads more like broad, opportunistic probing of exposed appliances than a single targeted operator. Treat those specifics as reported detail rather than figures we have independently confirmed.
What the Flaw Actually Is
CVE-2026-8037 is an operating-system command injection weakness: LoadMaster does not fully sanitize attacker-supplied input passed to certain command endpoints, and that input can be turned into commands that execute on the appliance itself. CISA's catalog entry describes it as a command injection vulnerability that lets an unauthenticated attacker run arbitrary commands on the LoadMaster. Progress has already shipped fixes. The vendor's critical security bulletin directs administrators to LoadMaster GA release 7.2.63.2 or LTSF release 7.2.54.18, both of which close the underlying bug. Anything earlier should be treated as affected until Progress's advisory tells you otherwise.
A load balancer is an unusually valuable target for this class of bug. It terminates and routes traffic for the services behind it, so command execution on the appliance can mean visibility into that traffic and a foothold deeper in the network than a single compromised workstation would give. That is why a command injection flaw here reads worse than the same bug on a lower-value host.
The Federal Clock
A KEV listing starts a remediation clock for federal civilian executive branch agencies. For CVE-2026-8037, that deadline is August 10, 2026 under Binding Operational Directive 26-04 — a compressed window rather than the roughly three weeks KEV entries often carry, consistent with CISA fast-tracking a publicly exposed asset that hands over full control once exploited. We saw the same compression on the recent N-able N-central KEV addition, where CISA set an unusually short due date for a flaw already under attack. Private-sector defenders are not bound by the date, but if your patch prioritization keys off KEV, this one has already crossed the threshold.
What Isn't Confirmed
A few things the listing does not settle, and I am flagging them rather than stating them as fact. The precise affected version range is not enumerated in the KEV entry itself — the fixed builds above are the anchor, so assume earlier releases are in scope pending Progress's advisory. No victim organizations have been named. And it is not clear whether the 792 figure counts successful compromises or includes attempts and scanning that never landed; the wording is "exploit attempts," so read it as attempts rather than confirmed breaches.
My Read
My read: the number that matters here is not 9.6, it is 792. A CVSS score tells you how bad exploitation would be; the attempt count tells you it is already happening. Command injection on a load balancer is a rough combination, because the device sits in front of application traffic and usually has network reach a compromised endpoint does not. Work the order deliberately: identify first, because the LoadMaster you have forgotten about is the one that is exposed; patch to a fixed build; then audit access logs for the window before you patched, since the upgrade stops new entry but does nothing about access that already occurred. The three-day federal deadline is the tell for how fast this is moving.
