If you run Progress LoadMaster (or the Kemp-branded versions of it), this is a patch-this-week story, not a note-for-later story. CISA has confirmed that a critical command injection vulnerability in the load balancer is being actively exploited in the wild, and the agency has added it to the Known Exploited Vulnerabilities catalog. That KEV listing is the clearest signal the industry has that real attackers are using this right now.
The vulnerability
The flaw is tracked as CVE-2026-8037, an OS command injection that earns a CVSS score of 9.6. That number is earned. The vulnerability lets an unauthenticated attacker run arbitrary commands on an unpatched appliance, which is about as bad as a network edge device can be. No credentials, no prior access, just direct code execution against a box that sits at the front of your infrastructure.
Affected versions include Kemp LoadMaster GA v7.2.63.1 or older and the LTSF line v7.2.54.17 or older. If you are running any of those, you are inside the blast radius. The fix lives in GA v7.2.63.2 and newer.
Why this one deserves attention
LoadMaster is an application delivery controller, which means it handles the traffic that flows in and out of your applications. It does TLS termination, load balancing, sometimes WAF duties, and it routes requests to backend servers. An attacker who owns that box does not just pop one server. They control the front door. They can redirect traffic, intercept or alter requests, reach backend networks that were only supposed to be reachable through the ADC, and in some cases move laterally from a position most network defenses are not watching closely.
Compounding that, these appliances are concentrated in exactly the places that make them attractive targets. Progress reports well over 100,000 LoadMaster deployments worldwide, with a heavy presence in government and large enterprise environments, including a large share of the Fortune 500. A single exploitable flaw in a box like that reaches a lot of high-value networks, which is why threat actors moved on it quickly once details surfaced.
What to do now
The immediate step is to update. Patch LoadMaster to GA v7.2.63.2 or newer, and do the same for any MOVEit WAF appliances in your environment, which share the affected codebase. If an appliance cannot be patched immediately because of change windows, treat it as an emergency exception rather than a scheduled one. CISA’s directive is blunt about the timeline for federal agencies: three days. The same urgency is justified in private sector environments.
After patching, look for signs of prior compromise. Review the appliance and API logs for unauthorized requests hitting command endpoints, unusual admin logins, and outbound connections you do not recognize. A command injection that has been public for even a short window is a candidate for earlier exploitation, so checking logs for activity before the patch matters, not just after it.
Because these boxes sit at the network edge and terminate connections that analytics often do not inspect deeply, consider whether your normal logging would even catch this. If your observability does not cover the ADC tier, that is a gap worth closing regardless of this specific CVE.
How this fits the bigger picture
This is another entry in a long-running theme: network edge appliances are the weak spot of modern security programs. They run vendor code, they are rarely patched on the same cadence as workloads, and they are exposed to the internet by design. When a critical flaw lands in one, the exploitation window is short and the damage potential is high. LoadMaster joins a familiar list of ADCs, VPNs, and gateways that have been burned this way, and the pattern keeps repeating for the same structural reasons.
The command injection here mirrors the class of bug that has hit other edge gear. What makes it stand out is the CVSS score and the confirmed exploitation. Progress is no stranger to high-profile vulnerabilities in this product family, and the earlier incidents taught the same lesson: patch the edge devices first, because those are the ones attackers reach without any help. The MOVEit WAF sharing the affected code is a reminder that one root cause can surface across several products, so check the whole portfolio, not just the box with the familiar name.
The lesson is not that LoadMaster is uniquely bad. It is that anything terminating traffic at your edge should be treated as a crown jewel for patching purposes. If you have not audited how quickly your network appliances get security updates, this is a decent moment to do it. Many teams run a tight patch cadence on servers and containers but let appliances drift, and the drift is exactly where these compromises live.
The takeaway
A patched ADC is boring. A compromised one is a headline, and given the CVSS 9.6 and active exploitation, this one is not worth gambling on. Update to GA v7.2.63.2 or newer, check for signs of any earlier intrusion in the logs, and use the incident as the nudge to look at how fast your edge infrastructure gets patched in general. If you are not sure whether your LoadMaster is affected, the version check takes minutes, and the cost of guessing wrong is your network’s front door.