Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts

A recently disclosed critical security flaw impacting Progress Kemp LoadMaster is seeing active exploitation attempts, according to an advisory from eSentire's Threat Response Unit (TRU). The Canadian cybersecurity company said it identified exploitation attempts targeting CVE-2026-8037 (CVSS score: 9.6), an operating system (OS) command injection flaw that could be exploited to achieve

According to eSentire TRU and technical analyses, CVE-2026-8037 is a critical pre-auth OS command injection vulnerability in Progress Kemp LoadMaster that allows unauthenticated remote code execution via the /accessv2 API endpoint when the API is enabled, and active exploitation attempts have been observed in the wild.[1][2][3] Public proof-of-concept exploit code is available, and vulnerable edge appliances can be used to gain initial access and pivot deeper into an organization’s network.[1][2][4] From a CyberSE.AI perspective, any AI agents or AI infrastructure that rely on LoadMaster as an upstream load balancer or API gateway inherit a significant supply-chain exposure: compromise of this appliance can let attackers tamper with AI traffic, intercept data, or alter model-serving endpoints. Organizations should treat affected LoadMaster instances as critical AI-adjacent components, include them in AI SBOM and supply-chain risk reviews, and rapidly patch, restrict API exposure, and continuously monitor for anomalous requests and command execution attempts.