Kemp LoadMaster CVE-2026-8037 Lands on CISA KEV

CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalog on Friday, August 8. The filing closes a loop that started June 4 when Progress patched the flaw, accelerated June 29 when a functional proof-of-concept hit the internet, and continued through 792 reported exploitation attempts that eventually cleared CISA’s confirmed-exploitation bar.

The July 3 coverage said to patch before this happened. This is that happening.

What the KEV listing changes

Practically: not the technical risk, which hasn’t moved. The flaw is still a CVSS 9.6 unauthenticated OS command injection in LoadMaster’s HTTP management interface. An attacker with network access to that interface can execute arbitrary commands on the appliance with no credentials. The patch has been available since June 4.

What the KEV listing does is set a federal deadline. CISA’s KEV policy requires civilian federal agencies to remediate listed vulnerabilities within 21 days of the catalog addition — a hard date of August 29, 2026 for CVE-2026-8037. Private-sector organizations aren’t bound by the same rule, but the KEV catalog has become the de facto triage priority signal for most enterprise patch programs, and the deadline logic holds: if 792 reported attempts didn’t clear your patch queue, CISA’s official listing should.

The honest timeline

Date	Event
June 4, 2026	Progress ships GA 7.2.63.2 and LTSF 7.2.54.18, fixing CVE-2026-8037
June 29, 2026	Functional PoC published publicly
June 29, 2026	eSentire TRU logs first active exploitation attempts
August 8, 2026	CISA adds to KEV after 792 reported attempts

The gap between patch and PoC was 25 days. The gap between PoC and KEV was 40 days. Every organization that still has an unpatched LoadMaster reachable from the internet lived inside those 40 days. The question now is whether they know it.

What to do

If you haven’t patched:

• GA branch: upgrade from 7.2.63.1 or earlier to 7.2.63.2
• LTSF branch: upgrade from 7.2.54.17 or earlier to 7.2.54.18

Both fixed versions have been available since June 4. There is no reason to stage this.

If you have patched and want to check for prior compromise: review logs for the 40-day window (June 29–August 8) for unexpected HTTP requests to LoadMaster’s management endpoint from unknown source addresses, unusual configuration changes, and new admin sessions from unfamiliar locations. If the appliance’s management interface was reachable from the internet during that window, assume it was probed and check accordingly.

Rotate any backend credentials the appliance holds — saved server credentials, SSL/TLS key material — as a standard post-exposure step.

If your management interface is still internet-exposed

Fix that too. Kemp’s own hardening guidance has consistently called for putting the management interface behind a management VLAN or VPN. A public PoC and 792 reported attempts on a single CVE make a stronger case than anything in a hardening guide. LoadMaster, BIG-IP, NetScaler, Fortinet FortiGate — any appliance whose compromise gives an attacker a foothold between the internet and the estate should not have its management surface reachable from the internet. That’s the pattern behind N-able N-central CVE-2026-18577 and Apache Tomcat’s recent KEV addition too.

Sourcing

• The Hacker News: Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts (2026-08-08)
• CISA KEV catalog: Known Exploited Vulnerabilities
• Progress vendor bulletin: LoadMaster Critical Security Bulletin — June 2026 (CVE-2026-8037, CVE-2026-33691)
• NVD: CVE-2026-8037