Critical Remote Code Execution in Progress Software Kemp LoadMaster (CVE-2026-8037)

Critical Remote Code Execution in Progress Software Kemp LoadMaster (CVE‑2026‑8037) Threatens Load‑Balancing Appliances

What It Is – A newly disclosed vulnerability (CVE‑2026‑8037) in the dodelapikey method of Progress Software’s Kemp LoadMaster allows an authenticated remote attacker to execute arbitrary code with root privileges. The flaw stems from uninitialized memory being accessed during API key deletion.

Exploitability – The vulnerability is actively exploitable; authentication is required but no additional privileges are needed. A proof‑of‑concept has been shared with the vendor, and a patch was released on June 9 2026. CVSS v3.1 base score 8.8 (Critical) – AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected Products – Progress Software Kemp LoadMaster (all versions prior to the June 9 2026 security update).

TPRM Impact –

• LoadMaster devices sit at the network edge for many SaaS, cloud‑hosted, and telco services; a compromise can cascade to downstream applications and customer data.
• Third‑party risk managers must treat any vendor relying on LoadMaster as a high‑severity supply‑chain exposure until remediation is verified.

Recommended Actions –

1. Patch immediately to the version referenced in the vendor advisory (LoadMaster 7.2.63‑2 or later).
2. Conduct an inventory of all LoadMaster appliances across your ecosystem; verify firmware levels.
3. Enable strict logging and alerting on the dodelapikey API endpoint; look for anomalous calls.
4. If patching cannot be performed within 30 days, isolate the affected load balancers from production traffic and consider temporary alternative routing.
5. Update third‑party risk registers to reflect the new CVE and communicate the remediation timeline to affected business units.

Source: Zero Day Initiative Advisory – ZDI‑26‑340