Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts

A critical OS command injection vulnerability (CVE-2026-8037, CVSS 9.6) in Progress Kemp LoadMaster is being actively probed in the wild; eSentire observed exploitation attempts beginning June 29, 2026 from multiple IP addresses. Technical analysis links the flaw to improper handling in an escape_quotes() function that allows heap manipulation and command injection via the /accessv2 endpoint. A public proof-of-concept exists, increasing exploitation risk, although observed attempts reportedly failed to produce post-compromise activity.