A critical flaw in Progress Kemp LoadMaster load balancers is being actively exploited by attackers right now, and the US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed it is on their list of vulnerabilities under real-world attack.

• What it is: A command injection bug (CVE-2026-8037, CVSS 9.6) that lets an attacker run commands on the device without needing a username or password.
• Who is affected: Businesses running Progress Kemp LoadMaster appliances to balance traffic across their servers or applications.
• The risk: Nearly 800 exploit attempts have already been recorded from attackers around the world, with a high likelihood of full device compromise if left unpatched.
• What to do: Apply the vendor's security patch immediately, and check whether your network includes a LoadMaster appliance if you are unsure.

If your business uses this product, we recommend patching without delay, or contacting us so we can check your environment for you.

Source: The Hacker News