Progress Kemp LoadMaster Pre-Auth RCE Advisory (CVE-2026-8037)

Vulnerability Overview The Progress Kemp LoadMaster team has confirmed two critical security vulnerabilities: CVE-2026-8037 and CVE-2026-33691. These vulnerabilities have been exploited in the wild, but there are currently no reports of direct operational impact. Affected Versions CVE-2026-8037: Remote Code Execution via Command Injection - Allows an unauthenticated attacker to execute arbitrary commands on LoadMaster devices by exploiting unvalidated input. - Affected versions: Kemp LoadMaster GA v7.2.63.1 and earlier. CVE-2026-33691: Bypass of OWASP CRS File Upload Extended Checks - Crafted HTTP multipart requests containing encoded malicious payloads can bypass the WAF's detection of API inputs for LoadMaster. - Affected versions: Kemp LoadMaster LTSF v7.2.54.17 and earlier. Remediation The Progress Kemp LoadMaster team strongly recommends upgrading firmware to the following latest versions: Progress Kemp LoadMaster GA v7.2.63.2 - Documentation link: XML Checksum verification file Progress Kemp LoadMaster LTSF v7.2.54.18 - Documentation link: XML Checksum verification file Progress ECS Connection Manager v7.2.63.2 - Documentation link: XML Checksum verification file Progress Connection Manager for ObjectScale v7.2.63.2 - Documentation link: XML Checksum verification file Customers with an active maintenance agreement can upgrade via the Download Center or by clicking the relevant links. Customers without an active maintenance agreement should contact their Progress Sales Representative or Partner. Additional Information Verifying Current Version: Log in to the LoadMaster Web UI and view the version string in the top right corner, or enter the console during startup to view version information. Technical Support: If you have any questions or concerns, log in to open a technical support case. Technical support is available to Progress Kemp LoadMaster customers within their warranty period and with active maintenance. If the model is no longer supported, please upgrade to a supported model in accordance with the product lifecycle policy. Disclaimer Information on this site may be derived from internal or external sources. Progress Software Corporation has made reasonable efforts to verify the information but does not guarantee its accuracy. Sample code is provided "as is" without any express or implied warranties. Additional Metadata Environment: No specific environment information. Last Modified Date: June 4, 2026, 11:37 AM Defect ID: No specific defect ID. Files No files uploaded. --- Note: Proof of Concept (POC) code or exploit code is not included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

Progress Kemp LoadMaster Pre-Auth RCE Advisory (CVE-2026-8037)