Critical Unauthenticated RCE (CVE-2026-8037) in Progress Software Kemp LoadMaster Threatens Enterprise Load‑Balancing

Critical Unauthenticated RCE (CVE‑2026‑8037) in Progress Software Kemp LoadMaster Threatens Enterprise Load‑Balancing

What It Is – Progress Software’s Kemp LoadMaster appliance contains an uninitialized‑memory flaw in the apiuser parameter of the accessv2 endpoint. The bug permits remote attackers to execute arbitrary code with root privileges without any authentication.

Exploitability – The vulnerability is actively exploitable; no credentials or user interaction are required. A proof‑of‑concept has been publicly released by the Zero Day Initiative. CVSS v3.1 base score 9.8 (Critical) (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected Products – Progress Software Kemp LoadMaster (all versions prior to the 7.2‑63‑2 update).

TPRM Impact –

• Load balancers sit at the front‑line of many SaaS, cloud, and on‑premise services; a compromise can cascade to downstream applications and data stores.
• An attacker with root on the appliance can pivot to internal networks, intercept traffic, or inject malicious payloads, creating a supply‑chain risk for any organization that relies on the LoadMaster for high‑availability or DDoS mitigation.

Recommended Actions –

1. Patch immediately to LoadMaster version 7.2‑63‑2 or later (see vendor release notes).
2. Verify that no legacy versions remain on the network; de‑commission or isolate them.
3. Conduct a post‑patch validation scan of the accessv2 endpoint to confirm the fix.
4. Review firewall rules and segmentation to limit external access to the LoadMaster management interface.
5. Update third‑party risk registers to flag LoadMaster as a high‑risk dependency until remediation is confirmed.

Source: Zero Day Initiative Advisory – ZDI‑26‑342 (CVE‑2026‑8037)