CISA Warns of Actively Exploited Progress Kemp LoadMaster Flaw
Summary
CISA says attackers are exploiting CVE-2026-8037, an unauthenticated command-injection flaw affecting Progress Kemp LoadMaster and MOVEit WAF. Progress released patches, and CISA ordered U.S. federal agencies to remediate within three days.
Key points
- CISA reported active exploitation of CVE-2026-8037, a critical command-injection flaw.
- Unsanitized API inputs can let unauthenticated attackers run arbitrary commands on affected appliances.
- Progress released fixes for affected LoadMaster and MOVEit WAF versions.
- CISA directed U.S. Federal Civilian Executive Branch agencies to secure affected servers within three days under BOD 26-04.
- Shadowserver reported nearly 300 exposed LoadMaster instances; the article says it is unclear how many are honeypots or have been secured.
Article Details
- Vulnerability Types
- Command injection
- Severity
- Critical
- Affected Versions
- Kemp LoadMaster GA v7.2.63.1 or older
- Kemp LoadMaster LTSF v7.2.54.17 or older
- MOVEit WAF before GA v7.2.63.2
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
Vendors
Products
MOVEit WAFProgress has already released patches, and CISA is urging all defenders to prioritize remediation, especially for the widely deployed LoadMaster and MOVEit WAF products.Progress LoadMasterCISA warned that attackers are actively exploiting CVE-2026-8037, a critical command injection flaw in Progress Kemp LoadMaster that can let unauthenticated threat actors run arbitrary commands on exposed appliances.