CISA Flags Kemp LoadMaster Flaw After Nearly 800 Exploit Attempts

Key points

• CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities list on Friday.
• The flaw sits in Progress Kemp LoadMaster, a widely deployed load balancer, and carries a severity score of 9.6 out of 10.
• Researchers logged 792 exploit attempts before the listing, according to The Hacker News.
• The bug lets an attacker with admin access run their own commands on the device.
• U.S. Federal agencies must patch or pull the product offline within the standard three-week KEV deadline.

A bug in equipment that sits at the front door of many corporate networks is now being actively abused, and the U.S. Government wants it fixed fast.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on Friday. That is the official list of bugs attackers are already using in the real world. The product in question is Progress Kemp LoadMaster, a load balancer: think traffic cop for web applications, routing each incoming request to the right server.

The flaw is tracked as CVE-2026-8037 and scores 9.6 on the 10-point severity scale. About as bad as these ratings get.

What does the bug actually let attackers do?

It lets them run their own commands on the LoadMaster device. Command injection means the software takes text a user supplies and mistakenly executes it as a system instruction rather than treating it as data.

Once an attacker can run commands on a load balancer, they're in a useful spot. These boxes decrypt web sessions and hold certificates. A foothold here reaches almost everything behind it.

The catch: an attacker needs an authenticated admin session to trigger the bug. That sounds reassuring until you recall how admin credentials tend to leak: reused passwords, sessions that never expire, phishing. Multi-factor authentication (a second login step, such as a code from an app) would blunt most of those routes, and it isn't switched on by default in most LoadMaster deployments.

How widely is it being exploited?

As first reported by The Hacker News, researchers counted 792 exploit attempts against the flaw before CISA moved it onto the KEV list. That's not background noise. Someone, or several someones, was scanning for these devices and trying their luck.

We first covered CVE-2026-8037 on 30 June 2026, and this KEV listing is the third story we've filed on it. The pattern tracks what we saw in July with a perfect-10 command-injection bug in Arista's VeloCloud Orchestrator: attackers find network-adjacent devices first, then defenders scramble.

CISA doesn't publish attacker identities or victim lists when it adds a bug to KEV. The listing is a signal: this is real, patch it.

Who has to act, and by when?

Federal civilian agencies in the U.S. Have three weeks from the KEV listing to patch affected LoadMaster systems or take them offline. Private companies aren't legally bound by that clock, but security teams and auditors treat KEV as a hard deadline too.

What should ordinary people do?

This sits inside company data centres, not on your phone or laptop. But if you work somewhere that runs Kemp LoadMaster, ask your IT team two questions today: are we patched, and is admin access protected with multi-factor authentication?

If the answer to either is no, that's the story.

Progress has issued fixed builds through its support portal. Admins should rotate any credentials that may have been exposed and review LoadMaster audit logs for command executions they can't explain.