Critical 9.6
KEV-listed
CVE-2026-8037
CISA adds Progress LoadMaster flaw CVE-2026-8037 to KEV due to active exploitation
Vendor / product: Progress LoadMaster
Event date: 2026-06-29
Public PoC: Yes
First tracked by RiskWire: 2026-07-28
CISA KEV catalog
Added to KEV
Federal remediation due
2026-08-10 (41 days overdue)
Ransomware campaign use
Unknown
CISA description
Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Sources & citations (8)
- U.S. CISA adds a Progress LoadMaster flaw to its Known Exploited Vulnerabilities catalog securityaffairs.com · 2026-08-08
- CISA Flags Progress LoadMaster Command Injection Vulnerability Exploited in the Wild gbhackers.com · 2026-08-10
- Critical Progress LoadMaster flaw now actively exploited in attacks bleepingcomputer.com · 2026-08-10
- Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts thehackernews.com · 2026-08-08
- CVE-2026-8037 Archives securityaffairs.com · 2026-08-08
- Progress LoadMaster Archives securityaffairs.com · 2026-08-08
- CISA Warns of Progress LoadMaster Command Injection Vulnerability Exploited in Attacks cybersecuritynews.com · 2026-08-10
- Kemp LoadMaster wird über CVE-2026-8037 angegriffen borncity.com · 2026-08-08
References
See CVE-2026-8037 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →