The U.S This article explores loadmaster reported exploited. . Cybersecurity and Infrastructure Security Agency (CISA) has identified a critical security flaw affecting Progress Kemp LoadMaster, which was reported to be exploited in the wild following initial reports of active attacks.
The vulnerability, known as CVE-2026-8037 (CVSS score: 9.6), is a command injection issue that could lead to arbitrary code execution on susceptible devices via un-sanitized input. CISA stated: "Progress LoadMaster includes a command injection vulnerability allowing an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints." In June 2026, watchTowr Labs highlighted this problem within the load balancer application's function named "escape_quotes()" and attributed it to improper handling of user-supplied input.
This enabled command injection, enabling attackers to run arbitrary commands without needing valid credentials. The addition of this flaw comes just over a month after eSentire reported seeing active exploitation efforts targeting the same vulnerability, despite these attempts being largely unsuccessful. The attacks originated from the following IP addresses: 192.42.116[.
]58, 192.42.116[. ]105, and 146.70.139[.]154. Based on telemetry data collected by KEVIntel, a total of 792 exploitation attempts were detected over the past 41 days from 65 unique IP addresses originating from 18 countries, including Australia, China, Indonesia, Japan, Poland, and the United States. The last activity was recorded on August 4, 2026, when five additional exploits were identified.
Given the ongoing threat, Federal Civilian Executive Branch (FCEB) agencies are advised to apply necessary patches by August 10, 2026, in compliance with Binding Operational Directive (BOD) 26-04 to safeguard their networks.
