Progress LoadMaster CVE-2026-8037: Root RCE Exploited 792 Times, Patch Your Load Balancer

CVE-2026-8037 targets the accessv2 management API endpoint in Progress LoadMaster. The attack vector is the apiuser parameter, which LoadMaster processes through the _escape_quotes() function before passing to the system() C library call.

The _escape_quotes() function is designed to sanitize user input by escaping shell metacharacters. The implementation flaw: the function allocates a heap buffer using malloc() but does not initialize the buffer contents and does not write a null terminator after writing escaped output. This creates an out-of-bounds read condition. When the function reads from the uninitialized buffer region, it reads from adjacent freed heap memory -- memory the attacker can spray with crafted content in advance of the main exploit request.

An attacker prepares the adjacent memory with command injection payload content, then sends a request to the accessv2 endpoint with a base64-encoded apiuser value that includes shell metacharacters such as semicolons and single quotes. The _escape_quotes() function's out-of-bounds read incorporates the attacker-controlled content from the sprayed heap memory. The resulting string, now containing the injected commands, passes to system() and executes as root on the LoadMaster appliance.

The attack requires only HTTP or HTTPS access to the LoadMaster management interface. No credentials, no session tokens, no prior foothold on the network. MITRE ATT&CK mappings: T1190 (Exploit Public-Facing Application) for initial access; T1059.004 (Unix Shell) for the command execution; T1562.001 (Impair Defenses: Disable or Modify Tools) for post-exploitation firewall rule manipulation.

CVE-2026-8037 affects all Progress Kemp LoadMaster GA versions from 7.2.60.0 through 7.2.63.1 -- every release in the current GA branch below the fixed version 7.2.63.2. On the long-term support branch, all LTSF versions from 7.2.45.12 through 7.2.54.17 are vulnerable, with 7.2.54.18 being the first fixed LTSF release.

The vulnerability also affects three related Progress products that share LoadMaster's underlying API code:

• ECS Connection Manager -- Progress's storage-optimized load balancing product for object storage workloads
• Connection Manager for ObjectScale -- Dell's ObjectScale integration relying on LoadMaster API code
• MOVEit WAF -- Progress's managed file transfer web application firewall component

Organizations running any of these products should verify their versions and patch to the fixed releases. The companion vulnerability CVE-2026-33691 was disclosed alongside CVE-2026-8037 and addresses a related input validation issue in the same API endpoint. Apply the June 2026 security bulletin, which covers both CVEs in a single update.

The EPSS score of 99% confirms that this vulnerability has the highest exploitation probability of nearly any CVE tracked in the EPSS database. LoadMaster appliances that expose their management interface to the internet are being actively scanned by automated tools. If your LoadMaster management port is reachable from outside your network, assume exploitation attempts are ongoing right now.

eSentire first observed active exploitation attempts against LoadMaster appliances on June 30, 2026 -- the day after watchTowr published detailed proof-of-concept code for CVE-2026-8037. Over the following 41 days, security researchers documented 792 exploitation attempts originating from 65 unique source IP addresses spread across 18 countries including Australia, China, Indonesia, Japan, Poland, and the United States.

The exploitation pattern is consistent with automated scanning tooling targeting all internet-exposed LoadMaster management interfaces. Early attempts on June 30 were reported by eSentire as largely unsuccessful, likely targeting appliances that had not yet received the June 2026 security bulletin. As unpatched appliances remained exposed through July, exploitation activity continued.

Three specific attacker IP addresses appeared repeatedly in the documented exploitation logs. Any connection from these addresses to a LoadMaster management interface should be treated as a confirmed exploitation attempt and trigger immediate investigation: 192.42.116.58, 192.42.116.105, and 146.70.139.154.

The geographic spread of attacker IPs and the 41-day continuous exploitation window indicate that CVE-2026-8037 has been incorporated into multiple automated exploitation frameworks, not just a single threat actor campaign. The Cisco FMC static credential CVE-2026-20316 compromise followed the same pattern: wide attacker interest in network edge appliances immediately after PoC publication.

The rule targets CVE-2024-1212, an earlier Progress Kemp LoadMaster command injection that used the same /access/set API endpoint and base64-encoded authorization injection technique. CVE-2026-8037 uses the accessv2 endpoint and apiuser parameter instead, but the detection logic covers both: GET requests to LoadMaster API paths with anomalous base64-encoded strings containing shell metacharacters.

• Deploy on: Web proxy or reverse proxy fronting the LoadMaster management interface
• Required logs: Full request URI and authorization headers

Apply the patch from the Progress LoadMaster Critical Security Bulletin June 2026 and complete the steps below. The CISA deadline for federal agencies was August 10. All other organizations should patch immediately.

The ServiceNow CVE-2026-6875 pre-auth RCE response demonstrated what happens when organizations treat CISA KEV deadlines as advisory: exploitation campaigns were already underway weeks before organizations completed remediation. CVE-2026-8037 is further along the same curve: 792 attempts confirmed before the KEV addition means active adversaries have catalogued your exposed appliances. Every day without the patch is another 19 attempts on average.

Load balancers occupy a position on the network that few other devices share: they sit between the internet and your application tier, inspect all incoming traffic, and hold the SSL private keys that decrypt every session. A compromised LoadMaster does not give attackers access to a single server -- it gives them access to a traffic interception point, a trusted internal network node, and the cryptographic material that makes your application encryption meaningful.

CVE-2026-8037 makes this compromise trivially achievable. No authentication. No insider knowledge required. A single HTTP request to the management API achieves root command execution on a device your network trusts implicitly.

The 792 documented exploit attempts confirm that automated adversaries have already indexed exposed LoadMaster appliances. The EPSS score of 99% reflects exploitation algorithms that predict nearly certain real-world exploitation based on the combination of a published PoC, a network-accessible attack surface, no authentication requirement, and a large installed base of appliances that are difficult to patch quickly due to their role in maintaining application availability.

Organizations that deprioritized this patch because the federal deadline seemed distant should recalibrate: CISA added this to KEV because attackers were already exploiting it before the August 7 catalog addition. The deadline was not a countdown to exploitation -- exploitation had already started 41 days earlier. Patch today. Restrict API access. Rotate credentials. Then run threat hunting queries against your log sources using the Sigma rule above to determine whether any exploitation attempt succeeded before your LoadMaster was patched.