CVE-2026-8037 Now Actively Exploited! Unauthenticated RCE in Progress Kemp LoadMaster and ECS Connection Manager
CVE-2026-8037 (CVSS 9.8, EPSS >= 100th pctl) is a critical, unauthenticated remote code execution (RCE) vulnerability in Progress Kemp LoadMaster and Progress ECS Connection Manager. eSentire reported that exploitation attempts began on June 29th, 2026, and the flaw has now been added to CISA’s Known Exploited Vulnerabilities (KEV) list. watchTowr Labs published a separate technical write-up with PoC exploit code, further increasing the risk and multiple national CERT alerts have been issued [1][2][3][4][5][6].
The OPENVAS ENTERPRISE FEED has included a remote banner check since June 8th, that covers both CVE-2026-8037 and CVE-2026-33691, an active check for detecting CVE-2026-8037 exploitability in Progress Kemp LoadMaster, and a separate remote banner check for Progress Kemp ECS Connection Manager. Grabbing a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED is a surefire way to gain the deepest insight into where software vulnerabilities exist in your organization’s IT infrastructure.
Successful exploitation of CVE-2026-8037 results in code execution with root-level privileges. When the API is enabled, the vulnerable path is reachable via the /accessv2 endpoint. Researchers attribute the flaw to improper handling of user-supplied input [CWE-20] in the escape_quotes() function, which can allow access to uninitialized heap memory. CVE-2026-8037 was disclosed by the vendor alongside CVE-2026-33691 (CVSS 7.5), a flaw in the OWASP Core Rule Set (CRS), which is a component of the same products.
A Risk Assessment for CVE-2026-8037
CVSS 9.8 · CriticalActively exploitedIn CISA KEVPublic PoC
CVE-2026-8037, affecting Progress Kemp LoadMaster is now considered actively exploited [1][2]. The flaw is a critical, pre-authentication RCE flaw that can be reached via the /accessv2 endpoint when the API is enabled. Exploitation allows an unauthenticated attacker to execute code with root-level privileges.
LoadMaster is used for load balancing enterprise application delivery, reverse proxying, SSL offloading, WAF-enabled high availability, and other networking functions. LoadMaster appliances are frequently positioned at the network edge and can have visibility into critical internal services, making a breach especially valuable to attackers. In operational terms, a pre-authentication RCE on a critical networking appliance in this position can provide a strong foothold for further activity inside the target network.
Mitigation of CVE-2026-8037 in Progress Kemp LoadMaster and ECS Connection Manager
Progress has published a security advisory with the fixed releases for both supported LoadMaster branches and ECS Connection Manager. The vendor indicates that patching is the only remediation path for CVE-2026-8037. Affected products include:
- Progress Kemp ECS Connection Manager prior to version 7.2.63.2
- Progress Kemp LoadMaster (GA) version 7.2.63.1 and prior
- Progress Kemp LoadMaster (LTSF) version 7.2.54.17 and prior
The OPENVAS ENTERPRISE FEED has included a remote banner check since June 8th, that covers both CVE-2026-8037 and CVE-2026-33691, an active check for detecting CVE-2026-8037 exploitability in Progress Kemp LoadMaster, and a separate remote banner check for Progress Kemp ECS Connection Manager.
Start Your Free Trial
The OPENVAS ENTERPRISE FEED includes a remote_banner check for CVE-2026-8037 and every other CVE in this advisory. Grab a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED to gain the deepest insight into where software vulnerabilities exist in your organization’s IT infrastructure.
Summary
CVE-2026-8037 is a critical, pre-authentication RCE flaw in Progress Kemp LoadMaster that is now considered actively exploited [1][2]. The vulnerable path can be reached through the /accessv2 API endpoint. Exploitation allows an attacker to execute code with root-level privileges. A full technical description and functional PoC are also available, increasing the risk.
The OPENVAS ENTERPRISE FEED has included a remote banner check since June 8th, that covers both CVE-2026-8037 and CVE-2026-33691, an active check for detecting CVE-2026-8037 exploitability in Progress Kemp LoadMaster, and a separate remote banner check for Progress Kemp ECS Connection Manager. Grabbing a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED is a surefire way to gain the deepest insight into where software vulnerabilities exist in your organization’s IT infrastructure.
Joseph has had a varied and passionate background in IT and cyber security since the late 1980s. His early technical experience included working on an IBM PS/2, assembling PCs and programming in C++.
He also pursued academic studies in computer and systems engineering, anthropology and an MBA in technology forecasting.
Joseph has worked in data analytics, software development and, in particular, enterprise IT security. He specialises in vulnerability management, encryption and penetration testing.
