Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Progress Kemp LoadMaster pre-auth command injection (CVE-2026-8037)

Vulnerability
First reported
Last updated
Happening score
H score 49
1 unique sources, 1 articles

Summary

Hide ▲

CVE-2026-8037 gives Progress Kemp LoadMaster with the API enabled a pre-auth command injection path that can run root commands on affected appliances. A patch is available, and Progress says it has no reports of exploitation so far. A working proof of concept is now public, raising the risk for exposed LoadMaster instances. Administrators should move to GA v7.2.63.2 or LTSF v7.2.54.18 and limit API reachability.

Related Happenings

Linux distributions mitigation advisories for CVE-2026-31431

Advisory/Mitigation
H score39 First: 30.04.2026 12:24 Last: 30.04.2026 12:24 Sources 1

About this happening: Multiple **Linux distributions** released advisories for **CVE-2026-31431**, adding mitigation guidance for a **Linux kernel local privilege escalation** that can let an unprivile...

Open Happening

Timeline

  1. 29.06.2026 03:00 2 articles · 1d ago

    watchTowr Labs publishes working proof of concept for LoadMaster root-command flaw

    Technical Analysis Update

    watchTowr Labs publishes a detailed exploit-chain analysis and working proof of concept for CVE-2026-8037, showing how crafted JSON requests to the /accessv2 endpoint can execute commands as root on LoadMaster.

    Show sources
    Open in new tab
  3. 04.06.2026 03:00 1 articles · 26d ago

    Progress publishes LoadMaster advisory and fixed versions for CVE-2026-8037

    Mitigation Patch Update

    Progress publishes its advisory for CVE-2026-8037, says it has not received exploitation reports, and releases fixed LoadMaster versions GA v7.2.63.2 and LTSF v7.2.54.18 for appliances with the API enabled.

    Show sources
    Open in new tab
  4. 15.04.2026 03:00 1 articles · 2mo ago

    Researcher reports LoadMaster command-injection flaw through ZDI

    Initial Disclosure

    A TrendAI Research researcher reports CVE-2026-8037 in Progress Kemp LoadMaster through the Zero Day Initiative, identifying a pre-auth API flaw that can let an unauthenticated attacker execute commands as root on affected appliances.

    Show sources
    Open in new tab