CVE-2026-8037: Pre-Authentication Remote Code Execution in Progress Kemp LoadMaster via escape_quotes() Heap Out-of-Bounds Read

CVE-2026-8037 (TL-2026-1132) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-05. It has no confirmed attribution, affects Progress Software / Kemp Kemp LoadMaster (GA), references 1 CVE (CVE-2026-8037), maps to 17 MITRE ATT&CK techniques (T1005, T1018, T1040), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-1132

Threat ID
TL-2026-1132
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-05
Last reviewed
2026-07-05
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
any sector operating internet-facing kemp loadmaster or ecs connection manager for objectscale appliances opportunistic not sector-specific as of this writing
Target regions
Global (opportunistic internet-wide exploitation of exposed appliances; no confirmed regional focus reported)
Detection rules
9
Indicators of compromise
16

Malware and tooling in CVE-2026-8037

Malware and tooling: watchTowr Labs CVE-2026-8037 PoC exploit

CVE-2026-8037 (CVSS 9.8) is a pre-authentication remote code execution vulnerability in Progress Kemp LoadMaster GA (<=7.2.63.1), LTSF (<=7.2.54.17), and Progress ECS Connection Manager for ObjectScale. A missing null terminator in the escape_quotes() sanitization routine causes an out-of-bounds heap read that attackers can weaponize by flooding JSON key-value pairs at the /accessv2 API endpoint to smuggle shell commands and gain root on the appliance. Public PoC code and active in-the-wild exploitation began June 29, 2026.

How CVE-2026-8037 works

CVE-2026-8037 affects Progress Kemp LoadMaster load balancer/application delivery controller (ADC) appliances whenever the device's management API feature is enabled and network-reachable. The root cause is a memory-safety defect in escape_quotes(), a C function intended to sanitize user-supplied input (specifically single quotes) before it is concatenated into a shell command string. In vulnerable versions, escape_quotes() allocates its output buffer with malloc() (leaving it uninitialized) and fails to append a null terminator after writing the escaped string. Because the buffer is not properly terminated, the subsequent __sprintf_chk()/sprintf() call that builds the final command string continues reading past the end of the escaped buffer into adjacent heap memory.

watchTowr Labs' independent patch-diff analysis and working proof-of-concept (published 2026-06-29) demonstrated that an attacker can groom the heap by sending a request to the pre-authentication /accessv2 API endpoint with a flood of extra JSON key-value pairs, causing an earlier allocation to be freed and a new allocation (containing the escape_quotes() output) to land adjacent to a freed chunk that still holds attacker-controlled, non-null-byte content. Sending four single quotes as the apiuser value causes escape_quotes() to emit sixteen escaped bytes, which is sufficient to overwrite the allocator's chunk metadata and cause the out-of-bounds read to walk into the attacker-placed payload, effectively smuggling unescaped shell command content into the final string that LoadMaster executes. Because the /accessv2 endpoint requires no authentication, this yields unauthenticated, root-level arbitrary command execution on the appliance.

Progress published its advisory on 2026-06-04 and Zero Day Initiative coordinated the public disclosure as ZDI-26-340 on 2026-06-09, crediting Syed Ibrahim Ahmed of TrendAI Research with discovery (reported to the vendor 2026-04-15). At the time of the vendor advisory, no exploitation had been observed. That changed on 2026-06-29, the same day watchTowr Labs published its full technical write-up and working exploit: eSentire's Threat Response Unit (TRU) began observing exploitation attempts against internet-facing LoadMaster appliances that same day, and security vendors subsequently issued sector-focused bulletins (2026-07-01) urging emergency patching.

Because LoadMaster and similar ADC devices are typically deployed at the network edge and terminate TLS for downstream applications, successful exploitation carries impact beyond the appliance itself: root access could enable theft of TLS private keys and certificates, manipulation of traffic routing/load-balancing rules, harvesting of stored credentials, and use of the compromised appliance as a pivot point for internal discovery and lateral movement. Progress fixed the defect by switching escape_quotes() to a zero-filling calloc() allocation and adding an explicit null terminator, shipped in GA 7.2.63.2 and LTSF 7.2.54.18. No public attribution to a specific threat actor or campaign has been established as of this writing; exploitation activity to date is consistent with opportunistic, internet-wide scan-and-exploit rather than a targeted campaign.

MITRE ATT&CK techniques used in TL-2026-1132

Collection

T1005 Data from Local System

Discovery

T1018 Remote System Discovery; T1082 System Information Discovery

Credential Access

T1040 Network Sniffing; T1552.004 Private Keys

Execution

T1059.004 Unix Shell

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Web Protocols

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Defense Evasion

T1211 Exploitation for Stealth

Persistence

T1505.003 Web Shell

Impact

T1565.002 Transmitted Data Manipulation

Resource Development

T1588.005 Exploits; T1588.006 Vulnerabilities

Reconnaissance

T1595.002 Vulnerability Scanning

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in CVE-2026-8037

  • Progress Software / Kemp — Kemp LoadMaster (GA)
    Vulnerable versions: 7.2.60.0 - 7.2.63.1; and all older GA releases
    Fixed in: 7.2.63.2
  • Progress Software / Kemp — Kemp LoadMaster (LTSF)
    Vulnerable versions: 7.2.45.12 - 7.2.54.17; and all older LTSF releases
    Fixed in: 7.2.54.18
  • Progress Software — ECS Connection Manager for ObjectScale
    Vulnerable versions: builds bundling the affected LoadMaster API component
    Fixed in: updated builds incorporating the LoadMaster 7.2.63.2 / 7.2.54.18 fix

Remediation for CVE-2026-8037

Patches

  • Kemp LoadMaster GA 7.2.63.2
  • Kemp LoadMaster LTSF 7.2.54.18
  • Progress ECS Connection Manager for ObjectScale build incorporating the corrected escape_quotes() implementation

Immediate actions

  • Upgrade Kemp LoadMaster GA to version 7.2.63.2 or later immediately
  • Upgrade Kemp LoadMaster LTSF to version 7.2.54.18 or later immediately
  • Update Progress ECS Connection Manager for ObjectScale to a build incorporating the fixed LoadMaster API component
  • If immediate patching is not possible, disable the LoadMaster API feature until the upgrade can be applied
  • Review LoadMaster API/access logs for anomalous /accessv2 requests, unusually large numbers of JSON key-value pairs, or repeated single-quote sequences in the apiuser field

Workarounds

  • Disable the LoadMaster API feature if it is not operationally required
  • Restrict network reachability of the API/management interface to trusted administrative networks or VPN only

Longer-term hardening

  • Place ADC/load-balancer management interfaces on a dedicated out-of-band management network that is never exposed to the internet
  • Implement network segmentation so that compromise of an edge appliance cannot directly pivot into internal systems
  • Centralize network appliance logs into a SIEM and monitor for unexpected process execution or configuration changes on ADC devices
  • Establish an expedited patch SLA for internet-facing ADC/load-balancer software given the recurring history of pre-auth RCE in this device class

CVEs associated with CVE-2026-8037

CVE-2026-8037

Weaknesses (CWE) in CVE-2026-8037

CWE-170, CWE-125, CWE-78, CWE-665

Timeline of CVE-2026-8037

  • Security researcher Syed Ibrahim Ahmed of TrendAI Research reports the escape_quotes() heap vulnerability in Kemp LoadMaster to Progress Software via the Zero Day Initiative (ZDI).
  • Progress Software publishes its initial security advisory for CVE-2026-8037, stating no exploitation had been observed at the time.
  • Zero Day Initiative publishes coordinated advisory ZDI-26-340 for CVE-2026-8037, confirming the pre-authentication RCE and a CVSS score of 9.8.
  • eSentire's Threat Response Unit (TRU) observes the first in-the-wild exploitation attempts against internet-facing LoadMaster appliances, coinciding with the public PoC release.
  • watchTowr Labs publishes an independent patch-diff analysis and a working proof-of-concept exploit demonstrating full pre-auth root command execution via the /accessv2 endpoint.
  • Cyber Security News, SC Media, GBHackers, and other outlets publish summaries of the vulnerability and its exploit mechanics, raising broader awareness.
  • The Hacker News and other outlets report continued active exploitation attempts targeting unpatched LoadMaster appliances, noting potential downstream risk to traffic routing, TLS termination, and internal network access.
  • Security vendors issue sector-focused threat bulletins warning organizations running exposed Kemp LoadMaster or ECS Connection Manager for ObjectScale appliances to patch immediately.

Sources cited for CVE-2026-8037

Threats related to CVE-2026-8037

Detection coverage for TL-2026-1132

As of 2026-07-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1132 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats