Skip to content
Critical RCE Vulnerability in Progress Kemp LoadMaster Exposed

Critical RCE Vulnerability in Progress Kemp LoadMaster Exposed

First seen 30 Jun 2026, 13:59 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •July 1, 2026 at 13:47 UTC
  • •CVE-2026-8037 allows unauthenticated remote code execution on Kemp LoadMaster devices.
  • •The vulnerability is due to an uninitialized memory issue in the API handling.
  • •First public proof of concept was released on June 30, 2026, increasing exploitation risk.

A critical pre-authentication Remote Code Execution (RCE) vulnerability, tracked as CVE-2026-8037, has been identified in Progress's Kemp LoadMaster, a widely used edge load balancer and ADC. This flaw allows unauthenticated attackers to execute arbitrary shell commands by exploiting an uninitialized memory/string-termination issue in the device's API handling. The vulnerability poses a significant risk to enterprise networks globally, as it requires no login credentials for exploitation. The first public proof of concept (PoC) was released on June 30, 2026, heightening concerns about potential attacks. Organizations using Kemp LoadMaster are urged to assess their exposure and implement necessary security measures immediately. The vulnerability's critical nature necessitates prompt action from affected entities to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 97d ago How this analysis works

Timeline

2026-06-04
CVE-2026-8037 published
Progress disclosed a critical RCE vulnerability in Kemp LoadMaster affecting its API handling.
Gbhackers
2026-06-30
First public PoC released
A proof of concept demonstrating the exploitation of CVE-2026-8037 was made public, raising urgency for remediation.
Gbhackers
2026-06-30
Critical vulnerability reported
Cybersecurity news outlets reported on the critical nature of the vulnerability, emphasizing the risk to enterprise networks worldwide.
Cybersecuritynews

More articles in this cluster (3)

Following this threat?

Track CVE-2026-8037 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 4