CISA Adds Progress Kemp LoadMaster Command Injection Flaw CVE-2026-8037 to KEV Catalog After Confirmed Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency has added a known command injection vulnerability in Progress Software's Kemp LoadMaster application delivery product to its Known Exploited Vulnerabilities catalog. The flaw, tracked as CVE-2026-8037, allows unauthenticated attackers to execute arbitrary commands on affected devices because input values are not properly sanitized. CISA issued the addition on August 7, 2026, and directed federal agencies to apply mitigations by August 10, 2026. The same product was previously targeted through another flaw, CVE-2024-1212, which was also added to the KEV list after exploitation. Security researchers note that the vulnerability poses a broad risk because it requires no authentication and can be leveraged to compromise load balancers and related infrastructure. Organizations using Progress Kemp LoadMaster are urged to review vendor advisories and implement available patches without delay.
Security NEXTAug 10, 2026Translated from Japanese