[HIGH PRIORITY] Progress Kemp LoadMaster Unauth Root RCE (CVE-2026-8037)

⚠ HIGH PRIORITY — CISA KEV (Aug 7, 2026). Active exploitation confirmed. CVE-2026-8037 is an OS command injection in Progress Kemp LoadMaster and ECS Connection Manager. Unauthenticated attackers send crafted requests to the /accessv2 API endpoint to execute arbitrary shell commands as root. 792+ exploit attempts from 65 IPs documented; public PoC available.

Affected LoadMaster

• LoadMaster GA 7.2.63.1 and prior → fix: 7.2.63.2
• LoadMaster LTSF 7.2.54.17 and prior → fix: 7.2.54.18
• ECS Connection Manager prior to 7.2.63.2
• Internet-exposed LoadMaster management/API interfaces

Check version

# LoadMaster WebUI → System Configuration → System Parameters
curl -sk https://LOADMASTER_IP/access/getversion
grep -i version /etc/loadmaster/release 2>/dev/null

Patching Method

1. Upgrade LoadMaster GA to 7.2.63.2 or LTSF to 7.2.54.18.
2. Download firmware from Progress Kemp portal: https://kemptechnologies.com
3. Schedule maintenance window — backup config before upgrade.
4. Apply via WebUI: System Configuration → System Update → Install.
5. Verify version post-upgrade; reboot if prompted.
6. Forensic review: audit /accessv2 API logs for malicious apiuser values.
7. Rotate LoadMaster admin, API, and SSL certificates after confirmed exposure.
8. Inventory all Kemp/LoadMaster appliances — including forgotten edge load balancers.

# Block /accessv2 from untrusted networks until patched
# Monitor for command injection in apiuser parameter
grep -i 'accessv2\|apiuser' /var/log/loadmaster/*.log

Until patched

• Restrict LoadMaster management API to management VLAN / jump-host IPs
• Disable API access from internet if not required
• EPSS 99% — expect continued automated scanning

CVSS: 9.6–9.8 Critical. Root-level RCE without authentication.