The patch was published June 4. Exploitation started June 29. The KEV listing came August 7.
CVE-2026-8037 — CVSS 9.6 — unauthenticated command injection in Progress Kemp LoadMaster. Hundreds of exploit attempts from dozens of IP addresses across multiple countries before CISA ever put it on the list.
WHAT ACTUALLY HAPPENED
LoadMaster fails to sanitise user-supplied input across several command endpoints, reachable through /accessv2 when the API is enabled.
The root cause is a memory handling bug in the escape_quotes() function: a heap buffer allocated with malloc() and an escaped string that is never properly null-terminated. From there an unauthenticated attacker executes arbitrary commands on the appliance.
Progress shipped the fix on June 4. On June 29, watchTowr Labs published functional technical research — and eSentire observed exploitation attempts the same day.
CISA added it to KEV on August 7 with a three-day federal deadline.
WHY THE LOAD BALANCER IS THE WORST PLACE TO LOSE
A load balancer is not another server on the list. It sits in front of the applications, terminates TLS, and therefore holds private keys and sees traffic in cleartext.
It is also, by definition, internet-facing and always on. Nobody takes the ADC down casually, which is precisely why it lags months behind everything else in the patch cycle.
Code execution there gives an attacker plaintext session tokens, credentials in transit, and a trusted position to reach the backend pool — from a device most SOCs do not monitor and most EDR cannot be installed on.
Note the timeline: same-day exploitation once public research landed. The dangerous interval is not patch-to-exploit any more. It is patch-to-write-up.
WHAT TO DO NOW
PATCH IMMEDIATELY IF YOU RUN LOADMASTER — the fix has been available since June and attackers have had a working path since June 29.
DISABLE THE API OR RESTRICT /accessv2 — if the management API is not in active use, turning it off removes the reachable path entirely.
HUNT BEFORE YOU CLOSE THE TICKET — check appliance logs for /accessv2 requests since late June and for any unexpected process or config change.
ROTATE THE TLS MATERIAL — if the device may have been reached, the certificates and keys it terminates should be considered exposed.
Edge appliances get patched last and matter most. That inversion is the whole business model of modern intrusion.
When was the last time your load balancers and ADCs were in a patch cycle — not your servers, the boxes in front of them?