Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth

A critical vulnerability in Progress Kemp LoadMaster, tracked as CVE-2026-8037, lets an unauthenticated attacker execute arbitrary commands as root on the appliance by sending a crafted request to its API, The Hacker News reported on June 30. The flaw carries a CVSS score of 9.8 according to the Zero Day Initiative, and a patch is available.

The defect sits in the appliance's escape_quotes() function, which sanitises user input before shell command execution, per the technical analysis cited in the report: the function allocated an uninitialised memory buffer and failed to add a null terminator to the sanitised string, letting attackers read past the sanitised input into adjacent memory and inject command payloads through extra JSON keys in API requests. The attack path runs through the /accessv2 endpoint, which handles credential validation, allowing unauthenticated command execution as root, per the report.

Affected releases are LoadMaster GA v7.2.63.1 and older and LTSF v7.2.54.17 and older, with fixes in GA v7.2.63.2 and LTSF v7.2.54.18, per the report. The flaw was discovered by Syed Ibrahim Ahmed of TrendAI Research and reported to Progress through the Zero Day Initiative on April 15, 2026; Progress published its advisory on June 9, and a technical analysis by watchTowr Labs followed on June 29, per the reporting.

Progress advises immediate patching where the API is enabled, and recommends operators evaluate whether API exposure at the network edge is necessary at all, per the report.

Background

LoadMaster is a load balancer and application delivery controller — an appliance that sits in front of servers to distribute traffic, terminate TLS and publish applications. Kemp Technologies, the product's original developer, was acquired by Progress Software in 2021, folding LoadMaster into Progress's infrastructure portfolio alongside products such as MOVEit and WhatsUp Gold.

Edge appliances of this class have become one of the most heavily targeted surfaces in enterprise security. Because they are internet-facing by design, hold privileged network positions and often run management interfaces alongside production traffic, flaws in load balancers, VPN gateways and file-transfer appliances have repeatedly been exploited at scale — frequently within days of public disclosure, and sometimes before. Pre-authentication root execution is the most serious category for such devices, since a single request can yield complete control of a system that mediates traffic for everything behind it.

What comes next

Deployments with the API enabled should update to GA v7.2.63.2 or LTSF v7.2.54.18 immediately, per the report, and operators would ordinarily review whether management APIs need to be reachable from untrusted networks. With a public technical analysis now available, exploit attempts against unpatched appliances become materially more likely; signs of in-the-wild exploitation, if any emerge, would surface through vendor updates and incident reporting.