A critical vulnerability in Progress Kemp LoadMaster allows an unauthenticated attacker to execute arbitrary commands as root on the appliance just by sending a crafted request to its API. The flaw, CVE-2026-8037, carries a CVSS score of 9.8. There is a patch available, and if you run LoadMaster with the API enabled, you should update immediately.
Progress published its advisory on June 4 (CVE-2026-8037) and says it has received no reports of active exploitation. However, researchers at watchTowr Labs published a detailed technical write-up on June 29 walking through the full exploit chain.
The vulnerability lives in a function called escape_quotes(), which is supposed to sanitize user input before passing it into a shell command. Its job is to escape single quotes so attackers cannot break out of a quoted string and inject commands. The problem is that it allocated a memory buffer without clearing it first and never wrote a null terminator at the end of the sanitized string.
That missing terminator is the entire exploit. Without it, the system keeps reading past the end of the sanitized input into whatever data happens to sit next to it in memory. An attacker can control what sits there by stuffing extra JSON keys into the same API request, each carrying a command injection payload. The system reads the sanitized input, keeps going, hits the attacker’s payload, and executes it as root.
The attack targets the /accessv2 endpoint, which handles API credential validation. No valid credentials are needed. The attacker sends a JSON body with a specially crafted apiuser value and dozens of extra key-value pairs containing the command they want to run.
Affected versions are LoadMaster GA v7.2.63.1 and older, and LTSF v7.2.54.17 and older, when the API is enabled. Fixed versions are GA v7.2.63.2 and LTSF v7.2.54.18. The patch itself is minimal — two changes: swapping the memory allocation function to one that zero-fills the buffer, and adding an explicit null terminator after the escaped output.
Progress also patched a second high-severity flaw in the same advisory: CVE-2026-33691, a WAF bypass where whitespace padding in filenames could circumvent file upload extension checks.
