Critical Vulnerability in Progress Kemp LoadMaster Enables Root Command Execution

Critical Flaw in Loadmaster

Progress Kemp LoadMaster, an application delivery controller used to manage network traffic, has a critical security flaw allowing unauthenticated attackers to execute root commands via API requests. This flaw, identified as CVE-2026-8037, has been rated with a CVSS score of 9.8, highlighting its severity.

Technical Details

The vulnerability resides in the escape_quotes() function, responsible for sanitizing input to avoid command injection. The function allocated memory without clearing it and omitted a null terminator, causing out-of-bounds reads. This flaw permits malicious actors to execute arbitrary commands.

Immediate Response Required

A patch has been released, and affected users are strongly advised to update immediately to avoid potential breaches. Although no current exploitation has been reported by Progress, cybersecurity firms have identified active attempts to exploit the vulnerability since June 29, 2026.

Implications for Security

As LoadMaster operates at the network edge, such vulnerabilities pose a significant risk. Without mitigation, attackers can exploit the flaw to gain privileged access to networks, making updates critical for maintaining organizational security.