CVE-2026-8037: Unauthenticated OS Command Injection in Progress Kemp LoadMaster via Uninitialized Heap in escape_quotes() (CVSS 9.6-9.8, Active Exploitation)

CVE-2026-8037 (TL-2026-1067), also tracked as ZDI-26-342, is a critical-severity software vulnerability scored CVSS 9.6, first published 2026-07-02 and last reviewed 2026-08-09. It has no confirmed attribution, affects Progress Software Kemp LoadMaster, references 1 CVE (CVE-2026-8037), maps to 23 MITRE ATT&CK techniques (T1003.008, T1005, T1040), and is covered by 9 detection rules and 26 indicators of compromise.

Key facts for TL-2026-1067

Threat ID
TL-2026-1067
Also known as
ZDI-26-342
Severity
CRITICAL
CVSS
9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-02
Last reviewed
2026-08-09
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
unknown
Target regions
global
Detection rules
9
Indicators of compromise
26
Updates
2026-08-09 · 2 updates · revalidated 2× · latest source

Malware and tooling in CVE-2026-8037

Malware and tooling: watchTowr Labs CVE-2026-8037 PoC exploit

A pre-authentication OS command injection vulnerability in Progress Kemp LoadMaster's /accessv2 API endpoint lets remote unauthenticated attackers execute arbitrary commands as root by exploiting an uninitialized-heap / missing-null-terminator bug in the escape_quotes() sanitization function. A functional public PoC and technical writeup from watchTowr Labs appeared on 2026-06-29, and eSentire's Threat Response Unit observed in-the-wild exploitation attempts beginning the same day.

How CVE-2026-8037 works

CVE-2026-8037 affects the `access` executable that backs Progress Kemp LoadMaster's REST API credential-validation logic. The vulnerable function, `escape_quotes()`, allocates its output buffer with `malloc()` (leaving it uninitialized) and fails to write a trailing null terminator after producing the escaped string. When the JSON body posted to the unauthenticated `/accessv2` endpoint sets `apiuser` to four consecutive single quotes (`''''`), each quote expands to the 4-byte sequence `'\''`, producing exactly 16 bytes of escaped output -- precisely enough to overwrite allocator metadata (fd/key pointers) in an adjacent, attacker-sprayed freed heap chunk. An attacker first sprays the heap with many JSON key/value pairs (`g0` through `g60`) containing an unescaped payload such as `AAAAAAAAAAAAAAAA'; cat /etc/passwd #`. Because the escaped `apiuser` buffer has no null terminator, the subsequent `__sprintf_chk()` call that builds the shell command `validuser -b %s -u '%s' -p '%s'` reads past the end of the buffer and pulls the sprayed payload directly into the command string, which is then passed to `system()`. This chains an uninitialized-heap read (CWE-908) and a missing null-termination bug (CWE-159) into full OS command injection (CWE-78), executing attacker-controlled shell commands with root privileges with no authentication required. The flaw affects LoadMaster GA versions up to and including 7.2.63.1 and LTSF versions up to and including 7.2.54.17 when the management/API interface is network-reachable. Progress fixed the issue in GA 7.2.63.2 and LTSF 7.2.54.18 by switching the allocation to `calloc()` (zero-filled memory) and explicitly writing a null terminator after the escaped string. The vulnerability was privately reported to Trend Zero Day Initiative on 2026-04-15 by researcher Syed Ibrahim Ahmed, tracked as ZDI-26-342 (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with Progress publishing its own advisory on 2026-06-04 and coordinated public disclosure on 2026-06-09. watchTowr Labs published a full technical exploit-chain writeup and functional PoC on 2026-06-29, the same day eSentire's Threat Response Unit began observing exploitation attempts from three distinct source IPs. eSentire reported that the exploitation attempts it observed failed and resulted in no post-compromise activity, but assessed that public PoC availability would drive an increase in malicious scanning and exploitation. No confirmed threat-actor attribution exists for the observed activity. LoadMaster previously suffered a near-identical-severity command injection flaw, CVE-2024-1212 (CVSS 10.0), also actively exploited, indicating a recurring pattern of unauthenticated command injection risk in this product's API layer.

MITRE ATT&CK techniques used in TL-2026-1067

Credential Access

T1003.008 OS Credential Dumping; T1040 Network Sniffing; T1552 Unsecured Credentials; T1557 Adversary-in-the-Middle

Collection

T1005 Data from Local System

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1087.001 Account Discovery

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Defense Evasion

T1211 Exploitation for Stealth

Resource Development

T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1588.005 Obtain Capabilities; T1588.006 Obtain Capabilities

Reconnaissance

T1590 Gather Victim Network Information; T1592 Gather Victim Host Information; T1595 Active Scanning; T1595.002 Active Scanning

Affected products and versions in CVE-2026-8037

  • Progress Software — Kemp LoadMaster
    Vulnerable versions: GA up to 7.2.63.1; LTSF up to 7.2.54.17
    Fixed in: GA 7.2.63.2; LTSF 7.2.54.18

Remediation for CVE-2026-8037

Patches

  • LoadMaster GA 7.2.63.2
  • LoadMaster LTSF 7.2.54.18

Immediate actions

  • Upgrade LoadMaster GA to 7.2.63.2 or later immediately
  • Upgrade LoadMaster LTSF to 7.2.54.18 or later immediately
  • Disable the LoadMaster management/API interface from internet exposure if patching cannot occur immediately
  • Restrict API access to trusted management networks via ACLs/firewall rules
  • Review LoadMaster access logs for POST requests to /accessv2 with anomalous apiuser values (repeated single quotes, oversized gN parameters)

Workarounds

  • Disable the LoadMaster API entirely if not required
  • Restrict inbound access to the API/management interface to trusted, internal-only source IPs

Longer-term hardening

  • Place LoadMaster management interfaces behind a VPN or bastion host, never directly internet-facing
  • Deploy network-based IDS/IPS signatures for anomalous /accessv2 POST payloads
  • Establish a routine firmware/patch cadence for network appliances and load balancers
  • Segment load-balancer/ADC management planes from production data planes

CVEs associated with CVE-2026-8037

CVE-2026-8037

Weaknesses (CWE) in CVE-2026-8037

CWE-78, CWE-908, CWE-159, CWE-77, CWE-125, CWE-170, CWE-457

Timeline of CVE-2026-8037

  • CISA adds the related CVE-2024-1212 (earlier unauthenticated LoadMaster command injection, CVSS 10.0) to the KEV catalog, establishing the recurring-pattern context cited in later reporting.
  • Researcher Syed Ibrahim Ahmed (TrendAI Research) privately reports the flaw to Trend Zero Day Initiative (ZDI-26-342).
  • Progress Software publishes its own security advisory for the vulnerability.
  • ZDI publicly releases advisory ZDI-26-342 (CVSS 9.8) as part of coordinated disclosure.
  • eSentire's Threat Response Unit begins observing in-the-wild exploitation attempts against the /accessv2 endpoint from three distinct source IPs.
  • watchTowr Labs publishes a full technical exploit-chain writeup with a functional public PoC exploiting the escape_quotes() heap bug.
  • The Hacker News and multiple outlets (GBHackers, cybersecuritynews.com) report on the flaw and available PoC.
  • eSentire TRU confirms the exploitation attempts it observed against CVE-2026-8037 failed and resulted in no post-compromise activity, while assessing that public PoC availability will drive increased scanning and exploitation attempts.
  • SOCRadar and The Hacker News report continued active exploitation attempts; eSentire notes observed attempts failed with no post-compromise activity.
  • KEVIntel telemetry (cited by The Hacker News) shows exploitation had reached 792 attempts from 65 unique source IPs across 18 countries over 41 days, with 5 attempts on the final day observed.
  • CISA adds CVE-2026-8037 to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation, invoking BOD 26-04 remediation requirements.
  • The Hacker News reports on the CISA KEV addition and the 792-attempt exploitation campaign, citing KEVIntel telemetry.
  • Deadline for FCEB federal agencies to apply vendor mitigations for CVE-2026-8037 under CISA BOD 26-04.

Update history for TL-2026-1067

Sources cited for CVE-2026-8037

Threats related to CVE-2026-8037

Detection coverage for TL-2026-1067

As of 2026-08-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1067 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats