Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth

A critical unauthenticated command-injection vulnerability (CVE-2026-8037, CVSS 9.8) in Progress Kemp LoadMaster allows attackers to execute arbitrary commands as root by sending a crafted JSON request to the /accessv2 API endpoint; Progress has released patches for affected GA and LTSF versions, a public proof-of-concept exists, and administrators are urged to update or restrict API exposure.