# CVE-2026-8037: Pre-Authentication Remote Code Execution in Progress Kemp LoadMaster via escape_quotes() Heap Out-of-Bounds Read

> CVE-2026-8037 (CVSS 9.8) is a pre-authentication remote code execution vulnerability in Progress Kemp LoadMaster GA (<=7.2.63.1), LTSF (<=7.2.54.17), and Progress ECS Connection Manager for ObjectScale. A missing null terminator in the escape_quotes() sanitization routine causes an out-of-bounds heap read that attackers can weaponize by flooding JSON key-value pairs at the /accessv2 API endpoint to smuggle shell commands and gain root on the appliance. Public PoC code and active in-the-wild exploitation began June 29, 2026.

- **Published:** 2026-07-05T00:00:00Z
- **Last reviewed:** 2026-07-05T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1132
- **ID:** TL-2026-1132
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-8037

## Description

CVE-2026-8037 affects Progress Kemp LoadMaster load balancer/application delivery controller (ADC) appliances whenever the device's management API feature is enabled and network-reachable. The root cause is a memory-safety defect in escape_quotes(), a C function intended to sanitize user-supplied input (specifically single quotes) before it is concatenated into a shell command string. In vulnerable versions, escape_quotes() allocates its output buffer with malloc() (leaving it uninitialized) and fails to append a null terminator after writing the escaped string. Because the buffer is not properly terminated, the subsequent __sprintf_chk()/sprintf() call that builds the final command string continues reading past the end of the escaped buffer into adjacent heap memory.

watchTowr Labs' independent patch-diff analysis and working proof-of-concept (published 2026-06-29) demonstrated that an attacker can groom the heap by sending a request to the pre-authentication /accessv2 API endpoint with a flood of extra JSON key-value pairs, causing an earlier allocation to be freed and a new allocation (containing the escape_quotes() output) to land adjacent to a freed chunk that still holds attacker-controlled, non-null-byte content. Sending four single quotes as the apiuser value causes escape_quotes() to emit sixteen escaped bytes, which is sufficient to overwrite the allocator's chunk metadata and cause the out-of-bounds read to walk into the attacker-placed payload, effectively smuggling unescaped shell command content into the final string that LoadMaster executes. Because the /accessv2 endpoint requires no authentication, this yields unauthenticated, root-level arbitrary command execution on the appliance.

Progress published its advisory on 2026-06-04 and Zero Day Initiative coordinated the public disclosure as ZDI-26-340 on 2026-06-09, crediting Syed Ibrahim Ahmed of TrendAI Research with discovery (reported to the vendor 2026-04-15). At the time of the vendor advisory, no exploitation had been observed. That changed on 2026-06-29, the same day watchTowr Labs published its full technical write-up and working exploit: eSentire's Threat Response Unit (TRU) began observing exploitation attempts against internet-facing LoadMaster appliances that same day, and security vendors subsequently issued sector-focused bulletins (2026-07-01) urging emergency patching.

Because LoadMaster and similar ADC devices are typically deployed at the network edge and terminate TLS for downstream applications, successful exploitation carries impact beyond the appliance itself: root access could enable theft of TLS private keys and certificates, manipulation of traffic routing/load-balancing rules, harvesting of stored credentials, and use of the compromised appliance as a pivot point for internal discovery and lateral movement. Progress fixed the defect by switching escape_quotes() to a zero-filling calloc() allocation and adding an explicit null terminator, shipped in GA 7.2.63.2 and LTSF 7.2.54.18. No public attribution to a specific threat actor or campaign has been established as of this writing; exploitation activity to date is consistent with opportunistic, internet-wide scan-and-exploit rather than a targeted campaign.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.005 Exploits
- T1588.006 Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1082 System Information Discovery
- T1018 Remote System Discovery
- T1210 Exploitation of Remote Services
- T1552.004 Private Keys
- T1040 Network Sniffing
- T1005 Data from Local System
- T1505.003 Web Shell
- T1071.001 Web Protocols
- T1565.002 Transmitted Data Manipulation

## Sources

- [Critical Progress Kemp LoadMaster Vulnerability Enables Pre-Auth Remote Code Execution](https://cybersecuritynews.com/critical-progress-kemp-loadmaster-vulnerability/)
- [Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)](https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/)
- [Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts](https://thehackernews.com/2026/07/latest-progress-kemp-loadmaster-pre.html)
- [Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth](https://thehackernews.com/2026/06/progress-kemp-loadmaster-flaw-could-let.html)
- [Progress Kemp LoadMaster vulnerability actively exploited](https://www.scworld.com/brief/progress-kemp-loadmaster-vulnerability-actively-exploited)
- [Critical Progress Kemp LoadMaster Vulnerability Enables Pre-Auth Remote Code Execution](https://gbhackers.com/progress-kemp-loadmaster-vulnerability/)
- [Kemp LoadMaster Vulnerability Exposes an Old Blind Spot](https://aardwolfsecurity.com/kemp-loadmaster-vulnerability-edge-devices/)
- [CVE-2026-8037: Progress Kemp LoadMaster RCE Exploited in the Wild](https://socradar.io/blog/cve-2026-8037-progress-kemp-loadmaster-rce/)
- [Progress Kemp LoadMaster Vulnerability Targeted (CVE-2026-8037)](https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037)
- [ZDI-26-340 Advisory](https://www.zerodayinitiative.com/advisories/ZDI-26-340/)
- [Critical Progress Kemp LoadMaster Vulnerability Enables Pre-Auth Remote Code Execution](https://teamwin.in/critical-progress-kemp-loadmaster-vulnerability-enables-pre-auth-remote-code-execution/)
- [Kemp LoadMaster CVE-2026-8037: Patch Pre-Auth Root RCE](https://howtofix.guide/kemp-loadmaster-cve-2026-8037-root-rce/)
- [Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts (community aggregation)](https://forum.ksec.co.uk/t/progress-kemp-loadmaster-pre-auth-rce-flaw-faces-active-exploitation-attempts/15969)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1132