CISA confirms active exploitation of critical Progress LoadMaster command injection flaw
A load balancer's API accepted unsanitised input, a reminder that edge appliances need the same patch discipline as the servers behind them.
The US Cybersecurity and Infrastructure Security Agency has confirmed that a critical command injection vulnerability in Progress Software's Kemp LoadMaster load balancer is being exploited in attacks, BleepingComputer reported on 10 August 2026. The flaw, tracked as CVE-2026-8037, allows an attacker with no credentials to run arbitrary commands on an unpatched appliance by sending unsanitised input to several of the product's API command endpoints.
The affected products include Kemp LoadMaster general availability releases up to and including version 7.2.63.1, long-term support releases up to and including 7.2.54.17, and all versions of the MOVEit WAF before 7.2.63.2. Progress released fixes in June 2026, so patched builds have been available for around two months.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 7 August and, under Binding Operational Directive 26-04, gave federal civilian executive branch agencies three days to apply the fix. The agency also urged organisations outside government to prioritise the update in order to block incoming attacks. According to Shadowserver data cited in the report, roughly 300 Kemp LoadMaster instances were reachable from the internet at the time.
LoadMaster is an application delivery controller that sits in front of web applications to distribute traffic, terminate encrypted connections and apply security policy. A device in that position holds a privileged view of traffic and credentials, which is why a pre-authentication code execution flaw in one attracts both attackers and emergency directives. The report did not attribute the exploitation to a particular group or describe what attackers did after gaining access.
Why it matters
Perimeter appliances such as load balancers, VPN gateways and firewalls have become a favourite entry point because they are exposed by design and are often patched less frequently than the servers behind them. The three-day federal deadline shows how quickly the window between public disclosure and mandated remediation is shrinking. The two-month gap between the June patch and confirmed exploitation is a reminder that a fix only protects the devices it is installed on. Anyone working in security or operations should expect the same pattern to repeat with the next edge product.
Attacker sends a crafted API request
No credentials are needed; the request targets one of several command endpoints on the appliance.
Input is not sanitised
Shell metacharacters in the input survive into the command the appliance builds.
Arbitrary command executes
The attacker's command runs on the LoadMaster itself, a device that terminates traffic for the apps behind it.
Fix: patch and restrict management
Update to 7.2.63.2 or later, and keep management interfaces off the public internet.
What you can learn from this
- Command injection. Command injection happens when an application builds an operating system command out of user-supplied text and passes it to a shell without properly separating data from instructions. Characters such as semicolons, pipes and backticks let an attacker end the intended command and start their own. Escaping functions try to neutralise those characters, but they are fragile because shells have many quoting rules and one missed case reopens the hole. The robust fix is to avoid the shell entirely by calling programs with an argument list, so the input can never be interpreted as syntax.
- Pre-authentication versus post-authentication flaws. A pre-authentication vulnerability can be triggered before the attacker proves who they are, so anyone who can reach the service can attempt it. A post-authentication flaw requires a valid session first, which raises the bar considerably. This distinction is why severity scores climb toward the maximum when no privileges are required and the attack works over the network. When you read an advisory, the phrase unauthenticated remote is the signal to act first.
- Application delivery controllers as attack surface. A load balancer or ADC terminates TLS, holds private keys, inspects requests and forwards them to internal servers. Compromising one gives an attacker plaintext traffic, a foothold inside the network boundary and a platform trusted by everything behind it. These devices also carry management interfaces and APIs of their own, which are the parts most often found vulnerable. Because they are appliances, teams sometimes treat them as fixed infrastructure rather than as software that needs the same update cadence as any server.
- The Known Exploited Vulnerabilities catalogue. CISA's KEV list records flaws with confirmed real-world exploitation and attaches a remediation due date for federal agencies. Its value for everyone else is prioritisation: thousands of CVEs appear each month, but only a small fraction are ever weaponised, and KEV names them. Binding operational directives turn the list into an obligation for US federal bodies, and many private organisations adopt the same deadlines voluntarily. Checking KEV is a cheap way to focus limited patching effort where attackers are already active.
- Management plane exposure. Every network device has a data plane, which forwards traffic, and a management plane, which configures the device. The management plane should be reachable only from trusted networks, yet internet-wide scans routinely find administrative interfaces exposed. Counts such as the roughly 300 instances seen by Shadowserver come from exactly this kind of scanning. Restricting management access does not fix a vulnerability, but it removes most of the internet from the set of people who can exploit it.
We teach this
How to use this in practice
- Inventory the edge of a network you control. For your home or lab network, list every device or service that accepts connections from outside: the router, any reverse proxy, a VPN endpoint, a NAS with remote access. For each, record the product, the installed version and the date it was last updated. Done looks like a table with no blank cells and a note beside any entry whose version you could not determine.
- Confirm no management interface faces the internet. From a connection outside your network, such as a phone on mobile data, run an
nmapscan against your public address or look up that address on a scanning service. Check whether any administrative ports, such as 22, 8443 or a vendor-specific management port, respond. Repeat the check after any router firmware update, since settings sometimes reset. Done looks like a scan result showing only the services you intend to expose, and a firewall rule change for anything else. - Write, exploit and fix a command injection. Create a twenty-line Python script that takes a hostname from the user and runs a ping using
subprocesswithshell=True. Feed it a hostname followed by a semicolon and a second command, and watch the second command execute. Then rewrite the call as an argument list without the shell and confirm the same input fails harmlessly. Done looks like two versions of the script and a sentence explaining why the second one cannot be tricked. - Automate a KEV check for products you use. Download CISA's Known Exploited Vulnerabilities feed in JSON form and write a script that filters entries by a list of vendor and product names relevant to you, printing the CVE, the date added and the due date. Run it once, save the output, and schedule it to run again every week. Done looks like a script you can run weekly and a printed list, even if today that list is empty.
Sources
- Critical Progress LoadMaster flaw now actively exploited in attacks — BleepingComputer
Our reporting is an original summary; full coverage is at the links above.
Don't just read about it — build it.
Square 1 teaches the skills behind the headlines, with every line of your work graded by AI. Find your starting point in 3 minutes.
Get your free skill report