Remote Code Execution in Progress Software Kemp LoadMaster (CVE-2026-8037) Threatens Load Balancer Administration
What It Is – A memory‑initialization flaw in the dolistapikeys method of Progress Software’s Kemp LoadMaster load balancer permits authenticated remote attackers to execute arbitrary code with administrator privileges.
Exploitability – The vulnerability (CVE‑2026‑8037) has a CVSS 7.2 (High) score. Exploits require valid credentials, but no public PoC has been released; the vendor has issued a patch.
Affected Products – Progress Software / Kemp LoadMaster (all supported versions prior to the June 2026 security update).
TPRM Impact – LoadMaster devices are often deployed as third‑party load‑balancing services for SaaS, cloud‑infra, and e‑commerce platforms. A compromised appliance can be leveraged to pivot into customer environments, intercept traffic, or disrupt services, creating a supply‑chain risk for downstream organizations.
Recommended Actions –
- Verify the version of Kemp LoadMaster in use and apply the vendor’s June 2026 security update immediately.
- Enforce multi‑factor authentication for all LoadMaster admin accounts.
- Conduct a configuration audit to ensure only required API keys are present and rotate any potentially exposed keys.
- Update network segmentation to isolate LoadMaster from sensitive internal systems.
- Monitor logs for anomalous
dolistapikeysactivity and enable intrusion‑detection signatures for this CVE.