CVE-2026-8037 is a critical OS command injection vulnerability in Progress Kemp LoadMaster appliances, allowing unauthenticated remote attackers to execute arbitrary commands as root. The flaw exists in the handling of the apiuser parameter in the accessv2 endpoint due to lack of proper memory initialization and improper escaping of user input in the escape_quotes() function. This leads to out-of-bounds reads and enables command injection via the system() function. The vulnerability affects LoadMaster GA versions up to 7.2.63.1 and LTSF versions up to 7.2.54.17. Exploitation attempts began shortly after public disclosure and proof-of-concept release in June 2026. Due to the device's typical placement at network edges, compromise could enable attackers to gain initial access and move laterally within networks. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog and strongly recommends immediate patching.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary commands with root privileges on vulnerable LoadMaster appliances. This can lead to full compromise of the device, potentially enabling attackers to access critical internal services and facilitate further malicious activity within the affected environment. The vulnerability is critical due to its remote, unauthenticated nature and the high level of access gained.

CISA urges immediate patching of the vulnerability. Progress has released advisories indicating that fixed versions are available beyond LoadMaster GA 7.2.63.1 and LTSF 7.2.54.17. Organizations should promptly apply these official patches to mitigate the risk. Because the vulnerability is actively exploited in the wild and listed in CISA's Known Exploited Vulnerabilities catalog, timely remediation is critical. No vendor advisory content indicates that no action is required or that the issue is already mitigated without patching.