Cybersecurity

CVSS 9.6 Flaw Hit Load Balancers 792 Times

A CVSS 9.6 command injection flaw in Progress Kemp LoadMaster was hit with 792 exploitation attempts before CISA added it to its KEV catalog on August 7, 2026. What load-balancer owners need to know.

CybersecurityBy Servola Tech Desk2026-08-124 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

CVSS 9.6 Flaw Hit Load Balancers 792 Times

Key takeaways

A CVSS 9.6 unauthenticated command injection flaw, CVE-2026-8037, was hit with 792 exploitation attempts from 65 unique IP addresses across 18 countries before CISA added it to its Known Exploited Vulnerabilities catalog on August 7, 2026. Any organization running an unpatched Progress Kemp LoadMaster appliance on the public internet should assume it has already been probed.
The flaw sits in the escape_quotes function that processes input on the /accessv2 API endpoint, letting an unauthenticated attacker run arbitrary commands with no login required. Patched versions are LoadMaster GA 7.2.63.2 and LTSF 7.2.54.18, and the same defect also affects MOVEit WAF builds before GA 7.2.63.2.
More than five weeks passed between the first observed exploitation attempts on June 30, 2026 and the CISA KEV listing on August 7, 2026. Owners who treat a KEV listing as their first patching trigger, rather than a vendor advisory or independent threat intelligence, are working a five-week delay into their own exposure.
Load balancers sit in front of nearly every internet-facing critical service an organization runs, yet network and infrastructure teams often patch them on a slower cycle than public web applications. For EU essential and important entities under NIS2, an unauthenticated remote code execution hole on an internet-facing appliance is a textbook trigger for mandatory significant-incident reporting.

Five Weeks of Attacks Before the Warning Arrived

Security firm watchTowr published a technical analysis and proof-of-concept exploit for CVE-2026-8037 on June 29, 2026, less than a month after Progress Software first disclosed the flaw on June 4. Within a day, eSentire's threat response unit was already logging exploitation attempts against Progress Kemp LoadMaster appliances, an unauthenticated command injection hole with a CVSS score of 9.6.

By the time the US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on August 7, 2026, telemetry compiled by eSentire and KEVIntel showed 792 exploitation attempts over 41 days, originating from 65 unique IP addresses in 18 countries including Australia, China, Indonesia, Japan, Poland, and the United States. CISA gave US federal civilian agencies until August 10, 2026, just three days, to patch under Binding Operational Directive 26-04. The gap that mattered most, though, was not that three-day federal deadline. It was the roughly five and a half weeks between the first real-world attack and the moment a KEV listing forced the issue onto most security teams' radar.

The Case for the Load Balancer as an Unwatched Target

A load balancer is not a peripheral system. It typically terminates or forwards traffic for every public-facing application an organization runs, which means it has network visibility and routing control that few other devices possess. Compromise one, and an attacker gains a foothold with visibility into everything that sits behind it, far beyond a single website going down.

Despite that exposure, load balancers and similar network appliances are routinely patched on a slower cadence than the web applications they front. Infrastructure and network teams often treat them as plumbing that, once configured, should not be touched outside a scheduled maintenance window. That habit is precisely what makes an unauthenticated, pre-authentication remote code execution flaw like CVE-2026-8037 so dangerous: the appliance most exposed to the internet is frequently the one least likely to be patched on an emergency basis.

Inside the Flaw: A Sanitization Function That Does Not Sanitize

CVE-2026-8037 lives in a function called escape_quotes, whose job is to strip dangerous characters from user-supplied input before that input reaches a shell command. The function fails to do so completely, and the flaw is reachable through the /accessv2 API endpoint whenever the LoadMaster API is enabled. An attacker needs no credentials at all; a specially crafted request is enough to have the appliance execute arbitrary commands.

The vulnerability affects LoadMaster GA version 7.2.63.1 and earlier, and LoadMaster LTSF version 7.2.54.17 and earlier. Progress Software has also confirmed the same underlying defect in MOVEit WAF builds before GA 7.2.63.2. Fixed releases are available: LoadMaster GA 7.2.63.2 and LoadMaster LTSF 7.2.54.18. There is no substitute for applying them; disabling the API where it is not required reduces exposure but does not close the hole for deployments that depend on it.

Why This Is a NIS2 Trigger, Not Just a Patch Ticket

For organizations classified as essential or important entities under the EU's NIS2 directive, an unauthenticated remote code execution vulnerability on an internet-facing infrastructure appliance is close to a textbook example of what the directive's incident reporting rules were written for. A load balancer sitting at the network edge, reachable without credentials, and confirmed under active exploitation checks every box that regulators use to define a significant incident: confidentiality, integrity, or availability impact with the potential to cause considerable operational or financial damage.

That has a practical consequence beyond patching. If a LoadMaster appliance within scope of NIS2 was internet-facing and running a vulnerable version during the exploitation window, the incident reporting clock may already be running, independent of whether any compromise has been confirmed yet. Waiting for forensic certainty before assessing reporting obligations is a common and costly mistake.

What Owners Should Do This Week

Patch immediately if a Kemp LoadMaster appliance is running GA 7.2.63.1 or earlier, or LTSF 7.2.54.17 or earlier, and treat internet-facing instances as the priority. Do not wait for a scheduled maintenance window; the exploitation telemetry shows attackers are already scanning broadly rather than targeting specific organizations, which means unpatched appliances are found through automated, indiscriminate sweeps.

Beyond this single fix, use the five-week gap between first exploitation and KEV listing as a prompt to review how the organization tracks vendor advisories for network and infrastructure appliances specifically, a category patch programs built around application software often overlook. A patch-management program that only escalates once something appears on a government exploited-vulnerabilities list is, by definition, always going to be behind the attackers who found the flaw first.

Frequently asked questions

What exactly does CVE-2026-8037 allow an attacker to do?

It allows an unauthenticated attacker to send a specially crafted request to a Progress Kemp LoadMaster appliance's API and have the appliance execute arbitrary commands, with no login credentials required. The flaw carries a CVSS score of 9.6, reflecting both the ease of exploitation and the severity of a full compromise.

We are not a US federal agency. Does the August 10 CISA deadline apply to us?

The Binding Operational Directive deadline is legally binding only for US federal civilian executive branch agencies. It is not a compliance requirement for other organizations, but the 792 exploitation attempts logged before that deadline show the underlying attack activity is not limited to any one sector or jurisdiction, so the urgency applies far more broadly than the legal obligation does.

Our patch for this appliance is already scheduled for the next maintenance window. Is that fast enough?

Given that active exploitation began more than five weeks before this vulnerability received wide attention, and that attackers appear to be scanning indiscriminately rather than targeting specific victims, an unpatched internet-facing LoadMaster instance should be treated as an emergency change, not a routine one. If the next scheduled window is more than a few days away, request an exception.

CVE-2026-8037 is a reminder that the devices controlling traffic to your critical services deserve the same patching urgency as the services themselves, and waiting for a government list to say so is already too late for hundreds of organizations that were probed while everyone else was still watching the web app layer.

Progress SoftwareKemp LoadMasterCVE-2026-8037NIS2load balancersCISA KEV

Your Sandbox Was Attacked a Month Before the Warning

CISA catalogued two FortiSandbox flaws on 16 July. Attackers were exploiting them in mid-June, and a third from the same wave is still not listed. If KEV drives your patching, you are late.

4 min read

Cybersecurity

Progress tells ShareFile users to pull the plug

Progress Software told ShareFile customers to physically shut down on-prem Storage Zone Controllers over a credible threat. No patch, no CVE. What owners should learn.

3 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.