Critical Progress LoadMaster Flaw Now Exploited in Attacks

A critical Progress LoadMaster flaw is now being exploited in attacks, according to the US Cybersecurity and Infrastructure Security Agency (CISA). The vulnerability allows unauthenticated attackers to run commands remotely on unpatched appliances.

The issue affects Kemp LoadMaster, an application delivery controller and load balancer used by companies and public-sector organisations to manage incoming web traffic. Administrators should install the available security updates as soon as possible.

Critical command injection vulnerability

Tracked as CVE-2026-8037, the Progress LoadMaster flaw is a critical command injection vulnerability. Attackers can exploit unsanitised API inputs across several command endpoints to execute arbitrary commands without authentication.

This creates a serious risk for exposed or unpatched appliances. Once attackers gain command execution, they may be able to alter configurations, install malware, steal data or use the compromised system to move deeper into an organisation’s network.

Progress released patches for the vulnerability in June. The flaw affects Kemp LoadMaster GA versions 7.2.63.1 and earlier, as well as LTSF versions 7.2.54.17 and earlier.

It also affects all MOVEit WAF releases before GA version 7.2.63.2.

CISA confirms active exploitation

CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalog on Friday, confirming that threat actors are actively abusing the Progress LoadMaster flaw.

US federal civilian agencies must secure affected systems within three days under Binding Operational Directive 26-04. While that requirement applies specifically to federal agencies, CISA has urged all organisations to prioritise mitigation.

The agency warned that flaws of this kind are commonly used by malicious actors and can pose a substantial risk to enterprise networks.

Hundreds of instances remain exposed

Internet threat monitoring group Shadowserver reports that nearly 300 Kemp LoadMaster instances are exposed online. However, the total includes systems that may be honeypots, already patched or otherwise protected.

That uncertainty does not reduce the need to act. Organisations using LoadMaster should identify all deployed appliances, confirm their software version and apply the relevant updates without delay.

Security teams should also review logs and appliance activity for unexpected API requests, unusual commands, new administrator accounts or configuration changes. These checks can help reveal whether attackers attempted to exploit the vulnerability before patching.

Progress faces another recent security issue

The warning follows a separate security incident involving Progress ShareFile Storage Zone Controllers. Last month, the company told customers to shut down affected on-premises servers after identifying a credible external threat.

Progress later released fixes for a high-severity path traversal zero-day in ShareFile. The company said it had found no indication that customer accounts or data had been accessed.

Still, the active exploitation of CVE-2026-8037 makes the Progress LoadMaster flaw the more urgent concern for affected organisations. Patching internet-facing systems should be treated as an immediate priority.