A lately disclosed vital safety flaw impacting Progress Kemp LoadMaster is seeing energetic exploitation makes an attempt, based on an advisory from eSentire’s Risk Response Unit (TRU).
The Canadian cybersecurity firm stated it recognized exploitation makes an attempt focusing on CVE-2026-8037 (CVSS rating: 9.6), an working system (OS) command injection flaw that could possibly be exploited to realize arbitrary code execution on vulnerable units. The exploitation exercise commenced on June 29, 2026.
“OS Command Injection Distant Code Execution Vulnerability in API in Progress LoadMaster permits an unauthenticated attacker with permissions to execute arbitrary instructions on the LoadMaster equipment by exploiting unsanitized enter,” Progress stated in an advisory for the vulnerability launched early final month.
In an evaluation revealed this week, watchTowr Labs described the flaw as rooted in a operate named “escape_quotes()” inside the load balancer utility and that it stems from improper dealing with of user-supplied enter.
The issue was that the operate didn’t correctly null-terminate sanitized strings, thereby resulting in an out-of-bounds learn into adjoining heap reminiscence. An attacker might weaponize this loophole to concern specifically crafted requests to the “/accessv2” endpoint that manipulate the heap reminiscence to allow command injection.
The impression of profitable exploitation is extreme, because it permits an unauthenticated attacker to run arbitrary instructions on the affected equipment with out having to own legitimate credentials.
eSentire famous that exploitation efforts it noticed resulted in failure, on account of which no post-compromise exercise occurred. Nonetheless, the supply of a proof-of-concept (PoC) exploit and detailed technical specifics is predicted to drive malicious exercise towards CVE-2026-8037 within the fast future.
The assault makes an attempt originate from the next IP addresses –
- 192.42.116[.]58
- 192.42.116[.]105
- 146.70.139[.]154
CVE-2026-8037 is the second Progress Progress Kemp LoadMaster flaw to witness energetic exploitation efforts after CVE-2024-1212 (CVSS rating: 10.0), one other vital OS command injection vulnerability that could possibly be abused for arbitrary system command execution.
