CISA Adds CVE-2026-8037 to KEV: 792 Exploit Attempts Against…

CISA added CVE-2026-8037 to the Known Exploited Vulnerabilities catalog on August 7, 2026, after KEVIntel telemetry recorded 792 exploit attempts in 41 days. The pre-authentication command injection in Progress Kemp LoadMaster allows unauthenticated root code execution.

CISA added CVE-2026-8037 to the Known Exploited Vulnerabilities Catalog on August 7, 2026, confirming that a flaw in Progress Kemp LoadMaster — patched two months earlier — is now under active exploitation worldwide. According to telemetry data collected by KEVIntel and reported by The Hacker News, 792 exploit attempts were observed over 41 days from 65 unique IP addresses across 18 countries, with the latest activity recorded on August 4. The shift from theoretical vulnerability to documented threat triggers a patch deadline of August 10 for U.S. federal agencies under BOD 26-04.

Key Takeaways

CISA added CVE-2026-8037 to the KEV catalog on August 7, 2026, confirming active exploitation of a vulnerability known since April and patched in June.
The flaw is a pre-authentication command injection in Progress Kemp LoadMaster rated CVSS 9.6 by CISA and 9.8 by ZDI, allowing arbitrary command execution as root.
KEVIntel detected 792 exploit attempts over 41 days from 65 unique IPs in 18 countries; eSentire characterized the attempts as "largely unsuccessful."
BOD 26-04 requires Federal Civilian Executive Branch agencies to apply patches by August 10, 2026.

The Mechanics of the Flaw: From escape_quotes() to Command Injection

The technical core resides in the escape_quotes() function of the /accessv2 endpoint, which handles API credential validation. According to watchTowr Labs analysis published in The Hacker News on June 30, 2026, the function allocates a memory buffer without zeroing it and fails to write a null terminator at the end of the sanitized string. An attacker sends a JSON body with a crafted apiuser value and additional keys containing command injection payloads. Reading beyond the buffer boundaries into attacker-controllable memory areas enables arbitrary command injection with root privileges, without valid authentication.

Advisory ZDI-26-342, released June 9, 2026, confirms the sequence: "The specific flaw exists within the handling of the apiuser parameter provided to the accessv2 endpoint. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of root." The discovery is credited to Syed Ibrahim Ahmed of TrendAI Research, who reported the vulnerability to Progress via the Zero Day Initiative program on April 15, 2026.

Exploitation Data: The Shift from PoC to Real Attacks

The publication of the ZDI advisory in June 2026 did not immediately trigger mass exploitation. The Hacker News reported at the time that watchTowr Labs had developed a proof of concept but no attacks had been reported. The situation changed in July. KEVIntel data cited in the August 7, 2026 article shows sustained progression: 792 attempts distributed over 41 days, with geographic origins including Australia, China, Indonesia, Japan, Poland, and the United States. The latest spike — 5 attempts on August 4 — suggests activity has not ceased with KEV inclusion.

"According to telemetry data captured by KEVIntel, a total of 792 exploitation attempts have been observed over the last 41 days from 65 unique IP addresses from 18 countries" — The Hacker News, reporting KEVIntel data

eSentire, also cited by The Hacker News, reported active exploitation "a little over a month" before the KEV addition, characterizing the attempts as "largely unsuccessful." The dossier does not clarify whether the lack of success stems from active defenses on targets or errors in the attackers' exploit chains. The number of systems actually compromised remains unquantified.

Affected Versions and Remediation: Two Months of Exposure

Vulnerable versions include LoadMaster GA v7.2.63.1 and earlier, and LTSF v7.2.54.17 and earlier. Official release notes cited by The Hacker News indicate that patched versions GA v7.2.63.2 and LTSF v7.2.54.18 were released in June 2026, alongside the Progress advisory of June 4. The patch replaces the allocation function with one that explicitly zeroes the buffer and adds the null terminator, eliminating both factors that made the out-of-bounds read exploitable.

The roughly two-month window between the fix release and KEV inclusion represents the critical period during which unpatched systems remained exposed to a publicly known vulnerability with an available PoC. The lack of required authentication further lowers the attack threshold: any LoadMaster appliance exposed on reachable networks is potentially targetable without preliminary credentials.

Immediate Actions

Verify the Kemp LoadMaster version in production: GA builds prior to 7.2.63.2 and LTSF builds prior to 7.2.54.18 are vulnerable and require immediate update.
For U.S. FCEB agencies, meet the BOD 26-04 deadline of August 10, 2026 for patch application.
Inspect access logs for the /accessv2 endpoint for requests with anomalous JSON bodies containing additional keys or suspicious apiuser values.
Evaluate network segmentation to limit LoadMaster appliance reachability from unauthorized networks, reducing the pre-authentication attack surface.

From Coordinated Vulnerability to KEV Threat: The Assessment

KEV catalog inclusion is not a bureaucratic formality: it is the point where CISA activates binding compliance mechanisms for the federal public sector and signals to the private market that risk has moved from theoretical assessment to measured event. The 792 attempts documented by KEVIntel — with broad geographic distribution and persistence of over a month — indicate threat actors have integrated the flaw into their operational arsenals, not merely intelligence gathering.

The CVE-2026-8037 case reprises a recurring pattern in the lifecycle of infrastructure vulnerabilities: responsible discovery, timely patching, coordinated advisory publication, and finally — months later — the emergence of exploitation on systems that lagged in patch adoption. The gap between fix availability and real-world attacks is not technically determined by the vulnerability itself, but by the speed of correction adoption in organizational update paths. In this sense, the KEV functions as an accelerator of that adoption, converting technical awareness into operational obligation.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references