Progress Kemp LoadMaster CVE-2026-8037: Brief Summary of a Critical Unauthenticated Command Injection

Introduction

An unauthenticated OS command injection in the Progress Kemp LoadMaster API lets remote attackers execute arbitrary commands on the appliance without any credentials. It scores a CVSS 9.8. This is the second unauthenticated command injection in the LoadMaster API in roughly two years, after CVE-2024-1212, which Rhino Security Labs discovered in early 2024. It also arrives just two months after Progress patched four authenticated command injection flaws in the same product line.

Progress Kemp LoadMaster is an application delivery controller (ADC) and load balancer product line with hardware, virtual, and cloud-native deployments. Gartner lists it as the top alternative to F5 BIG-IP. Organizations use it for Layer 4/7 load balancing, WAF, SSL offloading, and global server load balancing. Progress Software acquired Kemp Technologies for $258 million in 2021 and folded the LoadMaster product family into its infrastructure software portfolio.

Technical Information

Root Cause: Unsanitized Input in API Command Endpoints

CVE-2026-8037 is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The vulnerability is in the API of Progress ADC Products, where multiple command endpoints pass user-supplied input to OS command execution functions without properly sanitizing it. These endpoints require no authentication, so any attacker with network access to the LoadMaster management interface can inject arbitrary OS commands.

Progress assigned a CVSS v3.1 base score of 9.8, with the vector string AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:

When NVD published the record on June 4, 2026, it was marked "Awaiting Enrichment," which means NIST had not yet formally assigned its own CVSS score. Some sources cite a score of 9.6, which may reflect a different scoring methodology or version.

Historical Parallel: CVE-2024-1212

The exploitation pattern for CVE-2026-8037 is consistent with CVE-2024-1212, the earlier unauthenticated command injection in LoadMaster. In that case, Rhino Security Labs showed that the /access REST API endpoint handed user input to a binary that read the REMOTE_USER and REMOTE_PASS environment variables from the basic authentication header. The binary passed these values unsanitized through a __sprintf_chk() function and executed the resulting string with a system() call. By injecting a single quote and semicolon into the base64-encoded authorization string, an attacker could break out of the intended command context and run arbitrary commands.

CVE-2026-8037 involves different endpoints, but again unsanitized input reaches OS command execution functions. The advisory refers to "multiple command endpoints," which confirms the pattern was more widespread than the prior patches addressed.

Relationship to the April 2026 Vulnerability Cluster

CVE-2026-8037 is a significant escalation from the April 2026 LoadMaster vulnerabilities. All four of those flaws required an authenticated attacker with specific permission levels:

CVE-2026-8037 removes the authentication barrier entirely, and the CVSS score jumps from 7.2 to 9.8. This suggests the April 2026 patches fixed specific command endpoints without a full audit of the API surface for the same unsanitized input pattern.

Companion Vulnerability: CVE-2026-33691 (WAF Bypass)

The same June 2026 bulletin also addresses CVE-2026-33691, a high-severity WAF bypass. The flaw exists because the OWASP Core Rule Set (CRS) does not normalize whitespace in filenames before it applies the regular expressions that check file extensions. A crafted HTTP multipart request carrying an encoded malicious payload, with whitespace padding in the filename, can bypass WAF detection on the LoadMaster appliance.

The two flaws compound each other. With a WAF bypass and an unauthenticated command injection in the same product, an attacker could first evade WAF protections and then exploit the API command injection.

Impact of Compromise

Load balancers and ADCs sit between external traffic and internal application servers, which gives them a privileged position in network architecture. An attacker who compromises a LoadMaster appliance could:

• Intercept and manipulate traffic flowing through the load balancer
• Pivot to backend application servers
• Disrupt availability of all load-balanced services
• Extract SSL/TLS certificates and encryption keys
• Modify WAF security policies to enable further attacks

Affected Systems and Versions

The vulnerability affects four product lines, with these vulnerable and fixed versions:

Administrators can find the current firmware version in the top right corner of the web UI, or in the console output after the appliance boots.

Progress strongly recommends upgrading to the latest fixed firmware version immediately. Customers on a current maintenance agreement can get the upgrade from the Progress Download Hub, along with XML checksum files for verifying the integrity of the firmware images. Customers not on a current maintenance agreement should contact a Progress Sales Representative or their respective Partner to obtain the update.

The advisory documents no workaround or compensating control as an alternative to patching. Restricting network access to the LoadMaster management API interface to trusted internal networks would reduce exposure, but it is not a complete mitigation.

Vendor Security History

Progress Software has a notable track record of critical security vulnerabilities across multiple product lines:

The most significant precedent is CVE-2023-34362 in MOVEit Transfer. The Clop ransomware group (TA505) began mass exploiting it in May 2023, and it affected thousands of organizations worldwide.

OS command injection flaws keep turning up across LoadMaster API endpoints, on both authenticated (April 2026) and unauthenticated (CVE-2024-1212, CVE-2026-8037) attack surfaces. That recurrence indicates a systemic deficiency in how the LoadMaster API codebase sanitizes input. Two separate patch cycles in 2026 alone have addressed command injection in this product, and the June disclosure confirms the April patches did not fully resolve the underlying pattern.

As of June 4, 2026, Progress reported no known exploitation of CVE-2026-8037 and no direct operational impact to customers. The CISA Known Exploited Vulnerabilities (KEV) catalog has not published an entry for it. However, VulnCheck research from May 2026 found that most routinely targeted CVEs disclosed in 2026 were not exploited at the time of disclosure but were used in the wild afterwards. For vulnerabilities with these characteristics, the window between disclosure and exploitation is typically short.

Organizations evaluating Progress products should factor this recurring vulnerability pattern into vendor risk assessments and demand evidence of systemic remediation beyond point patches.

References

• NVD: CVE-2026-8037
• LoadMaster Critical Security Bulletin, June 2026 (CVE-2026-8037, CVE-2026-33691)
• LoadMaster Vulnerabilities, Progress Community
• CVE-2024-1212: Unauthenticated Command Injection in Progress Kemp LoadMaster, Rhino Security Labs
• Progress Patches Multiple Vulnerabilities in MOVEit WAF, LoadMaster, SecurityWeek
• NVD: CVE-2026-3517
• NVD: CVE-2026-4048
• LoadMaster Security Vulnerabilities: April 2026 Cluster, Progress Community
• Progress Security Advisory AV26-371, Canadian Centre for Cyber Security
• Quantifying 2026 Routinely Targeted Vulnerabilities, VulnCheck
• MOVEit Transfer Critical Vulnerability (May 2023), Progress Community
• Kemp LoadMaster Vulnerabilities: WAF Bypass and OS Injection, SecurityOnline