Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth

A critical vulnerability in Progress Kemp LoadMaster allows an unauthenticated attacker to execute arbitrary commands as root by sending a crafted request to the appliance's API. The flaw has a CVSS score of 9.8 and can be exploited by sending a specially crafted request. A patch for the issue is available, and users who have the API enabled are advised to update. The vulnerability is tracked as CVE-2026-8037. Progress published an advisory for the issue in June. Users running LoadMaster with the API enabled should apply the patch to prevent potential exploitation.