The Load Balancer Was Supposed to Distribute Traffic. Attackers Used It to Run Commands.
Progress has fixed an unauthenticated command-injection flaw in LoadMaster, and CISA says attackers are already exploiting it. A vulnerable load balancer is more than an exposed application. It is an infrastructure control point that sees traffic before most of the systems behind it.
Unsanitised input reached operating-system commands
CVE-2026-8037 affects Progress LoadMaster. According to the vendor’s release notes, multiple API command endpoints and cipher-set functions did not properly sanitise input, allowing an unauthenticated attacker to execute arbitrary commands.
Progress rates the flaw critical with a CVSS score of 9.6. The National Vulnerability Database records a 9.8 score. Progress fixed it in LoadMaster 7.2.63.2 and the long-term support release 7.2.54.18.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 7 August and set a 10 August remediation deadline for US federal civilian agencies. That short window reflects the combination of remote access, missing authentication and confirmed exploitation.
The appliance’s position increases the consequences
Load balancers are designed to sit in privileged locations. They terminate or route connections, expose applications, store certificates and connect external traffic to internal services. They are frequently reachable from the internet by design.
Command execution on that device can therefore give an attacker a useful observation and pivot point. The exact impact depends on deployment, permissions and segmentation, but defenders should consider the possibility of configuration theft, traffic manipulation, credential exposure and movement toward the systems behind the appliance.
The presence of a fixed backend application does not neutralise a compromised load balancer in front of it. The edge device has its own operating system, management plane, secrets and trust relationships.
Management exposure needs a separate inventory
Organisations commonly inventory the public virtual services presented by a load balancer but pay less attention to the management interfaces and APIs that configure it.
The vulnerability sits in functions that accept commands through API and user-interface paths. Teams should identify every physical, virtual and cloud-hosted LoadMaster instance, determine which interfaces are externally reachable and confirm whether old appliances remain online after migrations.
External scanning can help find obvious exposure, but internal records still matter. A management interface restricted to a partner network or administration segment can remain exploitable if the attacker already has access there.
Update, then investigate the control plane
Progress recommends moving to a fixed release. With active exploitation confirmed, the response should include compromise assessment rather than a patch-only closure.
Defenders should:
- Upgrade to LoadMaster 7.2.63.2, 7.2.54.18 LTSF or a later fixed release.
- Restrict management and API access to dedicated administrative networks and trusted hosts.
- Review appliance logs, configuration history and administrator activity for unexplained commands or changes.
- Inspect certificates, API credentials and other secrets stored on or accessible from the appliance.
- Examine connections from the LoadMaster to backend systems for unusual destinations, timing or volume.
- Replace credentials and certificates where evidence suggests they may have been exposed.
- Rebuild from a trusted image if compromise is confirmed or the integrity of the appliance cannot be established.
Teams should also preserve evidence before wiping a suspected system. Edge appliances often retain less forensic history than general-purpose servers, and a hurried rebuild can remove the records needed to understand the intrusion.
The edge is part of the application
Infrastructure appliances can disappear from application security reviews because they are owned by a different team and delivered as products rather than code. Attackers do not respect that organisational boundary.
The application is only as trustworthy as the systems that route, decrypt and administer its traffic. Load balancers need the same disciplined exposure management, patch urgency, credential hygiene and incident-response planning as the servers they protect.
For affected LoadMaster customers, the immediate action is clear: install the fixed release. The next question is equally important: if someone executed commands on the traffic control point, what else did that position allow them to see or change?
