Key Takeaways<\/p>\n
- \n
- KEV on 7 Aug:<\/strong> CVE-2026-8037 was the only new entry that day. The remediation deadline 10 August 2026 applies to U.S. federal agencies under BOD 26-04 and serves in the DACH region as an urgency signal without its own legal obligation.<\/li>\n
- Exploitation attempts:<\/strong> KEVIntel logged 792 exploitation attempts in 41 days from 65 IP addresses across 18 countries. eSentire observed attempts from 29 June 2026 onward. In all observed cases exploitation failed and no post-compromise activity occurred.<\/li>\n
- Patch available since June:<\/strong> Affected versions are Progress Kemp LoadMaster GA up to 7.2.63.1 and LTSF up to 7.2.54.17. Fixed builds are 7.2.63.2 and 7.2.54.18. The unauthenticated attack path via \/accessv2 leads, if successful, to root privileges.<\/li>\n
- Ransomware status:<\/strong> CISA rates knownRansomwareCampaignUse for this entry as Unknown-no statement that ransomware exploitation is ruled out.<\/li>\n<\/ul>\n<\/div>\n
Related:<\/strong> BOD 26-04: Prioritising KEV and EPSS the right way \u00b7 Windows vulnerabilities: Patch order for critical assets<\/a><\/p>\n
What the 7 August KEV inclusion signals<\/h2>\n
What is the KEV catalog?<\/strong> The CISA Known Exploited Vulnerabilities Catalog lists flaws with confirmed active exploitation. U.S. federal agencies must remediate entries within the stated deadlines under Binding Operational Directive 26-04. For organisations and agencies in the DACH region, the catalog carries no legal obligation of its own; instead it functions as a prioritised urgency signal backed by robust telemetry and official assessment.<\/p>\n
On 7 August 2026 CISA added exactly one new entry to the KEV catalog: CVE-2026-8037, described as the Progress LoadMaster Command Injection Vulnerability. The due date in the entry is 2026-08-10-just three days after inclusion. For U.S. federal agencies this is a binding requirement under BOD 26-04; for German, Austrian and Swiss organisations it is a prioritised warning without legal force.<\/p>\n
The Canadian Centre for Cyber Security appended its Advisory AV26-552 on the same day to include the KEV entry. The parallel update shows that multiple authorities reached the same escalation threshold. CISA simultaneously rates knownRansomwareCampaignUse for this entry as Unknown-meaning the field cannot be shortened to \u201cno ransomware.\u201d<\/p>\n
The real finding for internal governance lies in the gap: the vendor patch has been available since 4 June 2026, the public proof-of-concept since 29 June 2026, yet the KEV inclusion only arrived on 7 August. Teams that schedule patches solely by CVSS scores and release windows detect this lag too late; teams that weigh exploitability and exposure earlier would already have moved this gap to the top of the queue in June.<\/p>\n
The Technical Attack Path on LoadMaster<\/h2>\n
CVE-2026-8037 allows an unauthenticated attacker to execute arbitrary commands on the LoadMaster appliance via unsanitized input across multiple command endpoints. The path runs through the API endpoint \/accessv2, provided the API is enabled. The root cause lies in the function escape_quotes(). It lacks null termination, resulting in a heap out-of-bounds read. This chain is described by eSentire with technical details from watchTowr Labs.<\/p>\n
\nDefinition · Pre-Auth RCE<\/p>\n
A remote code execution vulnerability that does not require prior authentication. The attacker needs no valid credentials and can directly coerce the appliance into executing arbitrary commands. In the case of CVE-2026-8037, these commands run with root privileges.<\/p>\n<\/div>\n
If successfully exploited, the injected commands run as root. Valid credentials are not required. LoadMaster typically sits in front of sensitive services and controls traffic. A root shell on the appliance is therefore not an isolated host issue-it opens the door to downstream systems and configurations that govern production traffic.<\/p>\n
Affected versions include Progress Kemp LoadMaster GA up to and including 7.2.63.1 and LTSF up to and including 7.2.54.17. Fixed versions are 7.2.63.2 and 7.2.54.18, respectively. This version range is drawn from eSentire\u2019s table based on vendor status as of 30 June 2026 and is confirmed by AV26-552 from the Canadian Centre for Cyber Security. Organizations that maintain asset inventories without build numbers or API flags cannot reliably scope the affected population.<\/p>\n
Severity assessments diverge noticeably. Media coverage and eSentire assign a CVSS score of 9.6, while the Zero Day Initiative rates the same CVE (ZDI-26-342) at 9.8. Both values indicate critical impact. The discrepancy belongs in the decision file, but it does not replace the need to verify whether the API is reachable and whether the patch level is correct.<\/p>\n
Timeline: From Disclosure to Regulatory Deadline<\/h2>\n
The Zero Day Initiative reported the vulnerability to Progress on 15 April 2026. On 4 June 2026, the vendor issued its bulletin and CVE disclosure. A functional proof-of-concept emerged on 29 June 2026, and eSentire observed exploitation attempts from that same day. On 7 August 2026, CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog, giving U.S. federal agencies until 10 August 2026 to remediate.<\/p>\n
The gap between disclosure and KEV entry is roughly two months; the gap between public exploit and KEV entry is just under six weeks. During this window, both the patch and the attack path were public. Organizations that treat KEV as their primary trigger act only when CISA adds the entry. Those that also monitor vendor fixes and proof-of-concept publications prioritized this CVE back in June.<\/p>\n
The three-day deadline after KEV inclusion underscores how CISA evaluates risk for its own scope. It intensifies the expectation of immediate remediation. For DACH stakeholders, the deadline remains a benchmark for urgency, but it does not create a domestic regulatory deadline. Relying on it alone imports U.S. federal logic and overlooks the earlier window for action.<\/p>\n
Telemetry: 792 Attempts and What They Don\u2019t Prove<\/h2>\n
KEVIntel reports 792 exploitation attempts over 41 days from 65 unique IP addresses across 18 countries. Among the locations mentioned are Australia, China, Indonesia, Japan, Poland, and the USA. The most recent recorded activity occurred on 4 August 2026, with five attempts. These figures describe scanning and exploit attempts. They do not confirm any successful compromises.<\/p>\n
\n\n792<\/div>\nExploitation attempts in 41 days (KEVIntel via The Hacker News, 08.08.2026)<\/p>\n<\/div>\n
\n65<\/div>\nUnique source IPs from 18 countries (KEVIntel, 08.08.2026)<\/p>\n<\/div>\n
\n10 August 2026<\/div>\nDeadline for US federal agencies per KEV entry (CISA)<\/p>\n<\/div>\n<\/div>\n
eSentire observed exploitation attempts beginning on 29 June 2026, the day the Proof-of-Concept was published. In the cases monitored by eSentire, exploitation was unsuccessful. There was no post-compromise activity. This limitation must accompany every reference to the 792 attempts. Anyone interpreting the figure as evidence of widespread takeovers is straying from the source material.<\/p>\n
For the SOC, this leads to a clear distinction. Telemetry on attempts justifies heightened detection and accelerated patching. It does not replace forensic confirmation of a breach. At the same time, the current lack of success in eSentire\u2019s cases does not permanently ease the risk assessment. The unauthenticated path remains and, if exploited successfully, ends in root access. A later successful attempt would abruptly change the situation.<\/p>\n
CISA maintains the knownRansomwareCampaignUse status as Unknown. The strict reading applies here as well. Unknown does not mean disproven. It means the agency has not documented any reliable attribution to ransomware campaigns. Incident-response plans should therefore continue to model LoadMaster compromises with lateral movement and data exfiltration. A ransomware angle should neither be assumed nor ruled out.<\/p>\n
What the Delay Reveals About Your Own Prioritization<\/h2>\n
Case CVE-2026-8037 exposes control gaps that are structurally embedded in many patch programs. A vulnerability allowing unauthenticated root execution on a load balancer carries high asset criticality. The patch was available early. The public exploit carried a clear timestamp. Yet for many organizations, it is only the KEV listing that marks the moment they treat the issue as \u201ctruly urgent.\u201d<\/p>\n
Three typical mechanisms explain this pattern. First: prioritization based solely on CVSS without exposure context. Scores of 9.6 and 9.8 signal severity but say nothing about the reachability of \/accessv2 within your own network. Second: reliance on government catalogs as the starting gun. KEV is a strong signal, but it arrives after attackers have already begun testing the PoC. Third: incomplete inventories of appliance builds and API status. Without these attributes, the vulnerability remains invisible in the queue.<\/p>\n
The delay in public escalation is therefore not an argument against KEV. It is an argument for an internal early phase. Vendor bulletins, CVE disclosures, and public Proofs-of-Concept are independent triggers. Combining them with asset class and internet exposure moves LoadMaster fixes ahead of the KEV line. Waiting buys time for attackers and squanders control time in the change window.<\/p>\n
For senior leadership, a concise review suffices. When did the patch enter release? When was the estate inventoried for build level and API flag? When did rollout begin? If the start date is after 7 August, the program is being steered too heavily by external catalogs. If the start date is already in June, the organization has productively used the interval between patch availability and KEV listing.<\/p>\n
Action Framework for DACH Decision-makers<\/h2>\n
First, take stock of your environment. All Progress Kemp LoadMaster instances must be checked against GA 7.2.63.2 and LTSF 7.2.54.18. At the same time, verify the API status and reachability of \/accessv2 from untrusted networks. Systems below the specified maximum versions must be patched. Systems with unnecessary API exposure require a hardening decision, even after the fix.<\/p>\n
\nImmediate LoadMaster Check<\/p>\n
- \n
- ✓<\/span>Determine version: GA up to 7.2.63.1 and LTSF up to 7.2.54.17 are affected.<\/li>\n
- ✓<\/span>Patch to 7.2.63.2 or 7.2.54.18 respectively.<\/li>\n
- ✓<\/span>Check if the API is active. The attack path runs via \/accessv2.<\/li>\n
- ✓<\/span>Isolate the management interface from the internet until the patch is applied.<\/li>\n
- ✓<\/span>Perform forensic triage on appliances exposed since 29 June.<\/li>\n<\/ul>\n<\/div>\n
Detection should incorporate the known attack patterns observed since 29 June 2026. The 792 recorded attempts and the five attempts on 4 August 2026 signal ongoing scanning activity. In eSentire\u2019s observations, exploitation remained unsuccessful and no post-compromise activity followed. Still, review logs for unusual API calls and unexpected process launches on the appliance.<\/p>\n
The US deadline of 10 August 2026 applies to US federal agencies under BOD 26-04. It carries no legal force in the DACH region. Yet it serves as a benchmark for how tightly CISA is constraining the remaining window of action. If you operate LoadMaster in the production path and have not yet rolled out the patch, you should impose the same internal urgency. The rationale is exposure and exploit posture-not the US directive itself.<\/p>\n
Finally, put your governance logic to the test. KEV entries remain required reading. They must not be the sole escalation lever for internet-facing appliances. Disclosure, vendor fixes, PoC evidence and telemetry on attempts need to trigger earlier. CVE-2026-8037 illustrates this sequence in stark relief: patch early, exploit public, exploitation attempts for weeks, KEV late, deadline tight, ransomware usage unknown.<\/p>\n
Frequently Asked Questions<\/h2>\n
Each question is locked. Tap to unlock the answer.<\/p>\n
\nDoes the deadline 10 August 2026 also apply to German companies?<\/strong><\/summary>\n
No. The remediation deadline 2026-08-10 in the KEV entry applies to U.S. federal agencies under Binding Operational Directive 26-04. In the DACH region, it serves as an urgency signal without its own legal obligation. The operational consequence arises from exposure and exploitation status, not from the U.S. directive.<\/p>\n<\/details>\n
\nDo the 792 recorded activities indicate successful attacks?<\/strong><\/summary>\n
No. KEVIntel counts 792 exploitation attempts over 41 days from 65 IP addresses across 18 countries. eSentire observed attempts starting 29 June 2026. In the cases monitored by eSentire, exploitation was unsuccessful and no post-compromise activity occurred. The figure describes attempts only. Documented compromises are not included.<\/p>\n<\/details>\n
\nWhich versions of Progress Kemp LoadMaster are affected?<\/strong><\/summary>\n
Affected are GA versions up to and including 7.2.63.1 and LTSF versions up to and including 7.2.54.17. Fixed versions are 7.2.63.2 and 7.2.54.18 respectively. The attack path runs via \/accessv2 when the API is enabled. The root cause is escape_quotes() with missing null termination and a heap out-of-bounds read.<\/p>\n<\/details>\n
\nWhat CVSS score applies to CVE-2026-8037?<\/strong><\/summary>\n
Reporting and eSentire list the score as 9.6. The Zero Day Initiative rates the same CVE under ZDI-26-342 at 9.8. Both values stand side by side. The discrepancy is real and should remain visible in risk documentation.<\/p>\n<\/details>\n
\nIs the vulnerability being exploited in ransomware campaigns?<\/strong><\/summary>\n
CISA classifies knownRansomwareCampaignUse for CVE-2026-8037 as Unknown. This is not a statement excluding ransomware exploitation. Shortening to \u201cno ransomware\u201d is impermissible. The assessment remains open until the agency issues a different classification.<\/p>\n<\/details>\n
<\/p>\n
Editor’s Picks<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/zabbix-xss-offen-monitoring-zugang-neu-absichern-cover-hero-1-250x141.jpg\")
<\/span>Reading Tip<\/span>CERT-Bund Reverses Zabbix Warning After 24 Hours<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/pixelsmash-ffmpeg-inventur-upload-pfade-cover-hero-250x141.jpg\")
<\/span>Reading Tip<\/span>ffmpeg is Everywhere: PixelSmash Forces Inventory Check<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/08\/chaindrop-npm-wurm-trifft-keyv-und-cacheable-cover-hero-250x141.jpg\")
<\/span>Reading Tip<\/span>ChainDrop: npm Worm Targets keyv and cacheable<\/span><\/span><\/p>\nMore from the MBF Media Network<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/08\/net-herunterladbar-heisst-nicht-betreibbar-29798347.jpg\")
<\/span>cloudmagazin<\/span>Downloadable Doesn’t Mean Deployable<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/08\/net-local-ai-governance-vor-dem-hardwarekauf-32868665-250x141.jpg\")
<\/span>Digital Chiefs<\/span>Local AI: Governance Before Hardware Purchase<\/span><\/span><\/a><\/p>\nImage source: AI-generated (August 2026)<\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"CVE-2026-8037 in Progress: Kemp LoadMaster has been listed in the KEV catalog since August 7th. The patch has been available since June 2026.","protected":false},"author":10,"featured_media":23096,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"But wait, that's not a German word; it's a CVE identifier. CVE stands for Common Vulnerabilities and Exposures, which is a system for class","_yoast_wpseo_title":"LoadMaster in the KEV List: Patch Has Been Available Since June","_yoast_wpseo_metadesc":"Progress Kemp LoadMaster vulnerability CVE-2026-8037 added to KEV catalog. Patch available since June. Learn what this means for your prioritization.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[255],"tags":[],"class_list":["post-23162","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-praxis-umsetzung-en"],"evm_reading_time_minutes":12,"wpml_language":"en","wpml_translation_of":23094,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/23162","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=23162"}],"version-history":[{"count":2,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/23162\/revisions"}],"predecessor-version":[{"id":24407,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/23162\/revisions\/24407"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/23096"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=23162"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=23162"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=23162"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- ✓<\/span>Patch to 7.2.63.2 or 7.2.54.18 respectively.<\/li>\n
- Exploitation attempts:<\/strong> KEVIntel logged 792 exploitation attempts in 41 days from 65 IP addresses across 18 countries. eSentire observed attempts from 29 June 2026 onward. In all observed cases exploitation failed and no post-compromise activity occurred.<\/li>\n