Critical Zero-Day Vulnerability in Progress Kemp LoadMaster Exposes Enterprise Networks A severe security flaw in Progress Kemp LoadMaster, tracked as CVE-2026-8037, has left enterprise networks worldwide vulnerable to unauthenticated remote code execution. The vulnerability, rated 9.8 (Critical) on the CVSS scale, allows attackers to execute arbitrary commands with root-level privileges on affected appliances without requiring authentication. Kemp LoadMaster is a widely used load balancer and application delivery controller, handling critical functions like traffic management, SSL/TLS offloading, and web application firewall protection. Since these devices often sit at the network perimeter, exploitation provides attackers with a direct pathway into an organization’s infrastructure, bypassing internal security controls. ### Root Cause & Exploitation Researchers at WatchTowr Labs identified the flaw in the `escape_quotes()` function, which fails to properly sanitize user input before passing it to a system shell. The issue stems from a missing null terminator in the output buffer, allowing an attacker to manipulate memory and inject malicious commands. Exploitation occurs via the /accessv2 API endpoint, where specially crafted JSON input containing four single quotes as the `apiuser` value triggers an out-of-bounds memory read. This enables attackers to overwrite adjacent heap memory, ultimately executing arbitrary commands with root privileges. ### Affected Versions & Patch Availability The vulnerability impacts: - Kemp LoadMaster GA 7.2.63.1 and earlier - LTSF 7.2.54.17 and earlier (when the API feature is enabled) Progress has released patched versions (GA 7.2.63.2 and LTSF 7.2.54.18), which address the issue by switching to zero-filled memory allocation and adding the missing null terminator. The fix also applies to Progress ECS Connection Manager and Progress Connection Manager for ObjectScale. Organizations running affected versions are advised to upgrade immediately, as unpatched devices remain exposed to attacks from both the public internet and internal networks. Those without active maintenance agreements should contact their vendor for updates. The flaw was first reported by researcher Syed Ibrahim Ahmed of TrendAI Research and disclosed by Progress on June 4, 2026. Given its severity, enterprises must prioritize remediation to prevent potential breaches.