Kemp LoadMaster RCE hits CISA KEV: patch by August 10

The box in front of your application is also a computer, and right now it's the one getting shelled. CVE-2026-8037 — a pre-auth command injection in Progress Kemp LoadMaster — landed on CISA's Known Exploited Vulnerabilities catalog on August 7 with a federal remediation deadline of August 10. If a LoadMaster sits between the internet and anything you run, this is a today problem.

What actually happened

Per The Hacker News, the flaw lives in an escape_quotes() function that mishandles user-supplied input, letting an unauthenticated attacker run arbitrary commands on the appliance. No credentials. No user interaction. The Canadian Centre for Cyber Security rates it critical and lists the affected builds as GA v7.2.63.1 and prior and LTSF v7.2.54.17 and prior. The fixed builds are GA 7.2.63.2 and LTSF 7.2.54.18.

Read the timeline, because it is the actual lesson. Progress shipped the fix on June 4. Nothing loud happened for three and a half weeks. Then watchTowr Labs published a full technical writeup and proof-of-concept on June 29, and exploitation attempts started the same day.

The volume since: 792 exploitation attempts over 41 days, from 65 unique IP addresses across 18 countries, with activity still logged as recently as August 4. This is not a theoretical CVSS number. It is a two-month-old campaign that CISA finally made official.

Why your edge appliances are the gap in your patch process

Here's the pattern we see in every small-business stack we audit. Application code gets patched, because someone owns it. Servers get patched, because a config-management tool owns them. The load balancer, the firewall, the VPN concentrator, and the NAS get patched when someone remembers — and nobody owns "remembering."

Those appliances are the worst place to have that gap. They terminate TLS, so they see plaintext. They hold certificates and private keys. They sit at the network edge with a management interface that someone exposed once during a migration and never closed. Root on a LoadMaster is not a foothold — it's a position in front of everything behind it.

Three things worth doing this week, in order. Patch to 7.2.63.2 or 7.2.54.18. Then assume the June 29 to August 9 window was contested — pull appliance logs, look for unexpected shell activity and config changes, and rotate any certificate or credential the appliance held. Then put every appliance on the same inventory as your servers, with a named owner and a vendor advisory feed, so the next one doesn't sit unpatched for the six weeks between quiet fix and public PoC.

That gap between vendor patch and public exploit is where this whole story happened. It was 25 days. Your patch cadence has to be shorter than that.

Sources: The Hacker News, watchTowr Labs, Canadian Centre for Cyber Security, CISA KEV catalog.