Loading story…
CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalog after reports of active exploitation against Progress Kemp LoadMaster. The flaw, rated CVSS 9.6, is an unauthenticated command injection issue caused by unsanitized input in multiple command endpoints, allowing remote attackers to execute arbitrary commands on vulnerable appliances. CISA’s catalog update increased the total KEV count from 1661 to 1662 and set a remediation deadline of 2026-08-10 for Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04.
Reporting on the exploitation said defenders observed sustained attack activity in the wild, with 792 reported exploit attempts originating from dozens of IP addresses across 18 countries. Prior technical analysis tied the vulnerability to LoadMaster’s escape_quotes() function, while CISA marked known ransomware use as unknown in the KEV entry. The addition places the LoadMaster flaw alongside other recently tracked exploited bugs in products including JetBrains TeamCity, N-able N-central, and Apache Tomcat.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
After adding CVE-2026-8037 to the Known Exploited Vulnerabilities catalog, CISA urged immediate remediation and gave federal agencies three days to patch the exploited Progress LoadMaster flaw. The directive followed confirmation that the unauthenticated command injection bug had been exploited in the wild.
CISA updated its Known Exploited Vulnerabilities Catalog to version 2026.08.07 and added CVE-2026-8037, a Progress LoadMaster command injection vulnerability that allows unauthenticated command execution via unsanitized input in multiple command endpoints. The catalog count increased from 1661 to 1662 entries.
KEVIntel telemetry recorded its last observed exploitation activity targeting CVE-2026-8037 on August 4, 2026, including five exploitation attempts that day. The broader telemetry covered 792 attempts from 65 unique IP addresses across 18 countries over 41 days.
At the end of July 2026, Progress released further LoadMaster security updates that also fixed CVE-2026-33691, a medium-severity vulnerability, alongside the attack-path fix discussed in the article. The vendor said versions prior to the listed patched releases were vulnerable.
Functional proof-of-concept exploit code for CVE-2026-8037 became public on June 29, 2026, increasing the risk of broader abuse of the Progress LoadMaster command injection flaw. The article ties subsequent exploitation attempts to exposed devices after public exploit details were available.
eSentire's Threat Response Unit identified exploitation attempts targeting CVE-2026-8037 beginning on June 29, 2026. The attempts reportedly failed, and eSentire said it detected no post-compromise activity.
Progress Software released security updates in June 2026 to fix CVE-2026-8037 in affected Kemp LoadMaster and MOVEit WAF versions. The flaw allows unauthenticated remote command execution via unsanitized API inputs in multiple command endpoints.
watchTowr Labs published an analysis of the Progress Kemp LoadMaster command injection flaw, linking it to the application's "escape_quotes()" function and improper handling of user-supplied input.
Shadowserver reported that nearly 300 Kemp LoadMaster instances were exposed online amid active exploitation of CVE-2026-8037. It said it was unclear how many of those systems were honeypots or already protected against exploitation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
11 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcemkd-cirt.mk
Open sourceheise.de
Open sourcethehackernews.com
Open sourcegithub.com
Open sourcecisa.gov
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Progress Software disclosed and patched serious vulnerabilities in **Kemp LoadMaster** that could let attackers compromise load balancers deployed at the core of enterprise networks. The most prominent issue, tracked as **`CVE-2026-8037`**, was described in public advisories as affecting API methods including `dodelapikey` and `dolistapikeys`, where improper handling of memory could allow remote code execution after authentication, in some cases with **root** or administrator-level impact. Separate reporting also characterized `CVE-2026-8037` as a critical API command-injection issue that could permit arbitrary command execution and full administrative control of the appliance. Progress released updates to address the flaws, including patched firmware versions **`v7.2.63.2`** and **`v7.2.54.18`**, and said the fixes also apply to **ECS Connection Manager** and **Connection Manager for ObjectScale**. A second vulnerability, **`CVE-2026-33691`**, affects the **OWASP CRS** handling of multipart requests by failing to normalize whitespace in filenames, creating a path to bypass firewall extension checks. Security researchers credited in the disclosures include **Syed Ibrahim Ahmed** and **Jacky Yang** of TrendAI Research, and defenders were urged to patch quickly because compromise of internet-facing load balancers could provide a foothold for deeper intrusion into enterprise environments.
Jul 2, 2026
CISA added 14 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog across two updates, citing evidence of active exploitation against widely used enterprise products from Fortinet, Microsoft, Adobe, Cisco, JetBrains, PaperCut, Kentico, Quest, and Zimbra. The newly listed flaws include issues in FortiClient EMS, Adobe Acrobat Reader, Microsoft Windows Common Log File System Driver, Microsoft Exchange Server, Host Process for Windows Tasks, Microsoft Visual Basic for Applications, JetBrains TeamCity, PaperCut NG/MF, Kentico Xperience, Quest KACE SMA, Zimbra Collaboration Suite, and Cisco Catalyst SD-WAN Manager, including privilege escalation, credential exposure, sensitive information disclosure, and cross-site scripting weaknesses. Reporting tied several of the vulnerabilities to real-world intrusion activity and ransomware operations. Microsoft said threat actor **Storm-1175** used `CVE-2023-21529` to deliver **Medusa ransomware**, while `CVE-2023-27351` has been linked to **Lace Tempest** deployments of **Cl0p** and **LockBit**. Defused Cyber also reported exploitation attempts against `CVE-2026-21643`, and CISA said federal civilian agencies must remediate the newly added flaws on deadlines running from late April into May 2026 under Binding Operational Directive requirements, while private-sector defenders were urged to prioritize the KEV entries for patching and exposure reduction.
Jun 29, 2026
CISA expanded its Known Exploited Vulnerabilities catalog in a series of June updates, adding four newly exploited issues across enterprise and software platforms. The agency first listed **CVE-2026-45247** in Mirasvit Full Page Cache Warmer, a deserialization flaw that can enable unauthenticated remote code execution through a crafted serialized PHP object in the `CacheWarmer` cookie. It then added **CVE-2026-42271** in BerriAI LiteLLM, a command injection bug that can let any authenticated user, including low-privilege internal-user key holders, execute arbitrary commands on the host. CISA directed organizations to apply vendor mitigations, follow **BOD 22-01** guidance for cloud services, or discontinue use if mitigations are unavailable. CISA later added three more exploited vulnerabilities: a **Google Chromium V8** out-of-bounds read/write flaw that could allow sandboxed remote code execution via a crafted HTML page, an **Arista EOS** packet decapsulation vulnerability, and a **Cisco Catalyst SD-WAN Manager** flaw that could allow an authenticated local attacker to execute arbitrary commands as root. The KEV catalog count rose from **1,610** to **1,617** across the updates, and CISA assigned remediation deadlines ranging from **2026-06-06** to **2026-06-23**. Separate GitHub commits also showed Rack maintainers fixing multipart parsing denial-of-service issues tracked as **CVE-2025-61770**, **CVE-2025-61771**, and **CVE-2025-61772**, but those fixes were not part of the KEV additions described in the June catalog changes.
Jun 29, 2026