# CVE-2026-8037: Unauthenticated OS Command Injection in Progress Kemp LoadMaster via Uninitialized Heap in escape_quotes() (CVSS 9.6-9.8, Active Exploitation)

> A pre-authentication OS command injection vulnerability in Progress Kemp LoadMaster's /accessv2 API endpoint lets remote unauthenticated attackers execute arbitrary commands as root by exploiting an uninitialized-heap / missing-null-terminator bug in the escape_quotes() sanitization function. A functional public PoC and technical writeup from watchTowr Labs appeared on 2026-06-29, and eSentire's Threat Response Unit observed in-the-wild exploitation attempts beginning the same day.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-08-09T03:34:49.471Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1067
- **ID:** TL-2026-1067
- **Severity:** CRITICAL (CVSS 9.6)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-8037

## Description

CVE-2026-8037 affects the `access` executable that backs Progress Kemp LoadMaster's REST API credential-validation logic. The vulnerable function, `escape_quotes()`, allocates its output buffer with `malloc()` (leaving it uninitialized) and fails to write a trailing null terminator after producing the escaped string. When the JSON body posted to the unauthenticated `/accessv2` endpoint sets `apiuser` to four consecutive single quotes (`''''`), each quote expands to the 4-byte sequence `'\''`, producing exactly 16 bytes of escaped output -- precisely enough to overwrite allocator metadata (fd/key pointers) in an adjacent, attacker-sprayed freed heap chunk. An attacker first sprays the heap with many JSON key/value pairs (`g0` through `g60`) containing an unescaped payload such as `AAAAAAAAAAAAAAAA'; cat /etc/passwd #`. Because the escaped `apiuser` buffer has no null terminator, the subsequent `__sprintf_chk()` call that builds the shell command `validuser -b %s -u '%s' -p '%s'` reads past the end of the buffer and pulls the sprayed payload directly into the command string, which is then passed to `system()`. This chains an uninitialized-heap read (CWE-908) and a missing null-termination bug (CWE-159) into full OS command injection (CWE-78), executing attacker-controlled shell commands with root privileges with no authentication required. The flaw affects LoadMaster GA versions up to and including 7.2.63.1 and LTSF versions up to and including 7.2.54.17 when the management/API interface is network-reachable. Progress fixed the issue in GA 7.2.63.2 and LTSF 7.2.54.18 by switching the allocation to `calloc()` (zero-filled memory) and explicitly writing a null terminator after the escaped string. The vulnerability was privately reported to Trend Zero Day Initiative on 2026-04-15 by researcher Syed Ibrahim Ahmed, tracked as ZDI-26-342 (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with Progress publishing its own advisory on 2026-06-04 and coordinated public disclosure on 2026-06-09. watchTowr Labs published a full technical exploit-chain writeup and functional PoC on 2026-06-29, the same day eSentire's Threat Response Unit began observing exploitation attempts from three distinct source IPs. eSentire reported that the exploitation attempts it observed failed and resulted in no post-compromise activity, but assessed that public PoC availability would drive an increase in malicious scanning and exploitation. No confirmed threat-actor attribution exists for the observed activity. LoadMaster previously suffered a near-identical-severity command injection flaw, CVE-2024-1212 (CVSS 10.0), also actively exploited, indicating a recurring pattern of unauthenticated command injection risk in this product's API layer.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1592 Gather Victim Host Information
- T1590 Gather Victim Network Information
- T1583 Acquire Infrastructure
- T1040 Network Sniffing
- T1557 Adversary-in-the-Middle
- T1210 Exploitation of Remote Services
- T1595.002 Active Scanning
- T1588.005 Obtain Capabilities
- T1588.006 Obtain Capabilities
- T1059.004 Command and Scripting Interpreter
- T1003.008 OS Credential Dumping
- T1087.001 Account Discovery

## Sources

- [CVE-2026-8037: Progress Kemp LoadMaster RCE](https://socradar.io/blog/cve-2026-8037-progress-kemp-loadmaster-rce/)
- [Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth](https://thehackernews.com/2026/06/progress-kemp-loadmaster-flaw-could-let.html)
- [Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts](https://thehackernews.com/2026/07/latest-progress-kemp-loadmaster-pre.html)
- [Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)](https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/)
- [ZDI-26-342](https://www.zerodayinitiative.com/advisories/ZDI-26-342/)
- [Progress Kemp LoadMaster vulnerability actively exploited](https://www.scworld.com/brief/progress-kemp-loadmaster-vulnerability-actively-exploited)
- [Critical Progress Kemp LoadMaster Vulnerability Enables Pre-Auth Remote Code Execution](https://gbhackers.com/progress-kemp-loadmaster-vulnerability/)
- [Critical Progress Kemp LoadMaster Vulnerability Enables Pre-Auth Remote Code Execution](https://cybersecuritynews.com/critical-progress-kemp-loadmaster-vulnerability/)
- [Critical Progress Kemp LoadMaster Vulnerability Enables Pre-Auth Remote Code Execution](https://teamwin.in/critical-progress-kemp-loadmaster-vulnerability-enables-pre-auth-remote-code-execution/)
- [LoadMaster Vulnerabilities](https://docs.progress.com/bundle/loadmaster-vulnerabilities-ga/page/Vulnerabilities.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1067