Progress Kemp LoadMaster API OS Command Injection Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-8037)

1. Apply Official Security Patches

Refer to the official Progress security bulletin and upgrade the LoadMaster firmware to the latest patched version immediately.

2. Temporary Mitigations

If immediate patching is not feasible, implement the following defensive measures:

• Restrict Management Access: Ensure that the LoadMaster Web User Interface (WUI) and API ports are not exposed to the public internet.
• Implement Access Control Lists (ACLs): Restrict API access exclusively to trusted administrative IP addresses.

  # Example: Block external access to LoadMaster API paths (e.g., /access/*) on WAF/Firewall
  Deny TCP traffic to port 8443 (or custom admin port) from non-whitelisted subnets

• IDS/IPS Signature Deployment: Monitor and block incoming API requests containing shell metacharacters (e.g., ;, &, |, ` `, $()`) in query parameters or request bodies.

CVE-2026-8037 is a critical OS Command Injection vulnerability (CWE-77) residing in the API endpoints of Progress Kemp LoadMaster.

The vulnerability exists due to insufficient sanitization of user-supplied input within multiple command-processing API endpoints. An unauthenticated, remote attacker can exploit this flaw by sending malicious payloads to execute arbitrary commands directly on the underlying operating system of the LoadMaster appliance.

With a CVSS 3.1 score of 9.8 (Critical) and active exploitation confirmed by its inclusion in the CISA KEV catalog, this vulnerability poses an immediate threat as an initial access vector into enterprise networks.