CISA Flags Kemp LoadMaster Flaw After Nearly 800 Exploit Attempts

Key points

• The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-8037 to its Known Exploited Vulnerabilities list on Friday.
• The flaw sits in Progress Kemp LoadMaster, a widely deployed load balancer, and carries a severity score of 9.6 out of 10.
• Researchers logged 792 exploit attempts before the listing, according to reporting from The Hacker News.
• The bug lets an attacker with admin access run their own commands on the device.
• U.S. federal agencies must patch or pull the product offline within the standard three-week KEV deadline.

A nasty bug in a piece of equipment that sits at the front door of many corporate networks is now being actively abused, and the U.S. government wants it fixed fast.

On Friday, CISA added the flaw to its Known Exploited Vulnerabilities catalog, the official list of bugs that attackers are already using in the real world. The product in question is Progress Kemp LoadMaster. Think of it as a traffic cop for websites and applications, deciding which server handles each incoming visitor.

The flaw is tracked as CVE-2026-8037 and scores 9.6 on the 10-point severity scale. That is about as bad as these ratings get.

What does the bug actually let attackers do?

It lets them run their own commands on the LoadMaster device. In technical terms this is called command injection, meaning the software takes text a user types in and mistakenly runs it as a system instruction instead of treating it as harmless data.

Once an attacker can run commands on a load balancer, they are sitting in a very useful spot. These boxes handle login traffic, decrypt web sessions, and often hold certificates. A foothold here is a foothold on almost everything behind it.

The catch: an attacker needs an authenticated admin session to trigger the bug. That sounds reassuring until you remember how admin credentials tend to leak. Reused passwords, old sessions that never expire, phishing, where criminals send fake emails to trick staff into handing over passwords. Would multi-factor authentication (a second login step, like a code from an app) have helped? Honestly, yes, and in most LoadMaster deployments it is not switched on by default.

How widely is it being exploited?

As first reported by The Hacker News, researchers counted 792 exploit attempts against the flaw before CISA moved it onto the KEV list. That is not background noise. Somebody, or several somebodies, is scanning for these devices and trying their luck.

CISA does not publish the identity of the attackers or the victims when it adds a bug to KEV. The listing is a signal: this is real, patch it.

Who has to act, and by when?

Federal civilian agencies in the U.S. have three weeks from the KEV listing to patch affected LoadMaster systems or take them offline. That deadline is set by Binding Operational Directive 22-01, the rule that gives KEV its teeth inside government.

Private companies are not legally bound by that clock, but insurers, auditors and most sensible security teams treat KEV as a hard deadline too.

What should ordinary people do?

Nothing directly. This is a piece of infrastructure that sits inside company data centres, not on your phone or laptop. But if you work somewhere that runs Kemp LoadMaster, nudge your IT team today. Ask two questions: are we patched, and is admin access protected with multi-factor authentication?

If the answer to either is no, that is the story.

Progress has issued fixed builds through its support portal. Admins should also rotate any admin credentials that may have been exposed, and review LoadMaster audit logs for command executions they cannot explain.