435/69 Tuesday, August 11, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-8037, a vulnerability affecting Progress Kemp LoadMaster, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming evidence of active exploitation. The flaw is a command injection vulnerability that could allow an unauthenticated attacker to execute commands on affected systems.
According to the report, the vulnerability is caused by insufficient validation of input submitted to certain API command endpoints, allowing an attacker to send specially crafted data and execute commands on the underlying system. The flaw affects Kemp LoadMaster GA version 7.2.63.1 and earlier, LTSF version 7.2.54.17 and earlier, as well as all MOVEit WAF versions prior to GA 7.2.63.2. Progress released security updates addressing the vulnerability in June 2026.
CISA has required U.S. Federal Civilian Executive Branch (FCEB) agencies to remediate the vulnerability within the specified deadline. Organizations using Progress Kemp LoadMaster are also advised to promptly review their environments and apply the latest security updates, while examining system logs and other activity for signs of suspicious or potentially malicious behavior. Given that exploitation of the vulnerability has already been confirmed in the wild, affected organizations should prioritize remediation as soon as possible.