Progress Kemp LoadMaster API Unauthenticated OS Command Injection (escape_quotes Heap Overflow to Root RCE)

CVE-2026-8037 is an unauthenticated OS command injection vulnerability in the management API of Progress Kemp LoadMaster, an application delivery controller deployed in over 100,000 instances across 80% of the Fortune 500. The flaw lives in the escape_quotes() function, which allocates heap memory via malloc() without initialization and fails to null-terminate the escaped output. An attacker sends four single quotes in the apiuser parameter to the /accessv2 endpoint; the resulting 16-byte expansion overwrites allocator metadata in an adjacent freed heap chunk. A preceding heap spray fills neighboring allocations with command injection payloads. When __sprintf_chk() reads the unterminated buffer, it continues past the boundary into the sprayed payload, which flows straight into a system() call and executes as root. Affected versions: LoadMaster GA ≤ 7.2.63.1, LTSF ≤ 7.2.54.17, ECS Connection Manager ≤ 7.2.63.1, ObjectScale Connection Manager ≤ 7.2.63.1, and MOVEit WAF sharing the same API code.

The vendor scored this 9.6 CRITICAL using AV:A (adjacent network), reflecting the architectural expectation that the management API sits on a dedicated management VLAN. That's technically honest but operationally naïve. Shadowserver found ~300 LoadMaster management interfaces directly exposed to the internet, and eSentire logged 792 exploit attempts from 65 IPs across 18 countries within 41 days of PoC publication. The NVD independently scored this 9.8 with AV:N, recognizing the real-world exposure pattern. For the vast majority of deployments behind firewalls, any compromised internal host or contractor VPN session reaches the management VLAN anyway. watchTowr published a fully weaponized proof-of-concept on June 29, 2026, and CISA added it to the Known Exploited Vulnerabilities catalog on August 7. The vendor's 9.6 understates the deployed risk — this is a 9.8 in practice.

Sources.

1. watchTowr Labs — Full Exploit Analysis & PoC
2. CISA KEV Alert — August 7, 2026
3. eSentire TRU Advisory — Exploitation Telemetry & IoCs
4. The Hacker News — 792 Exploit Attempts, CISA KEV Coverage
5. ZeroPath Blog — Technical Summary & Version Matrix
6. GitHub Advisory — GHSA-57pc-jm9r-hgj4
7. NVD Entry — CVE-2026-8037
8. Decryption Digest — Patch Guidance & Exposure Analysis

Run from an auditor workstation with network access to the LoadMaster management interface. Requires curl and coreutils (sort, grep). No special privileges needed — the script makes only an HTTPS GET to the login page to parse the firmware version, plus an optional authenticated API call. Usage: bash check_cve-2026-8037.sh 10.0.1.50 or bash check_cve-2026-8037.sh lb.corp.local my-api-key

#!/usr/bin/env bash
# CVE-2026-8037 Version Checker for Progress Kemp LoadMaster
# Usage: bash check_cve-2026-8037.sh <host> [api-key]
# Exit: 0=PATCHED  1=VULNERABLE  2=UNKNOWN
set -euo pipefail

TARGET="${1:?Usage: $0 <loadmaster-mgmt-ip-or-hostname> [api-key]}"
API_KEY="${2:-}"
FIXED_GA="7.2.63.2"
FIXED_LTSF="7.2.54.18"
VERSION=""

ver_gte() {
  printf '%s\n%s' "$1" "$2" | sort -V | head -n1 | grep -qx "$2"
}

echo "[*] CVE-2026-8037 Check - Target: ${TARGET}"

# Method 1: Authenticated API version query
if [[ -n "$API_KEY" ]]; then
  RESP=$(curl -sk --connect-timeout 10 \
    -H "Authorization: Bearer ${API_KEY}" \
    "https://${TARGET}/access/system/version" 2>/dev/null) || true
  VERSION=$(echo "$RESP" | grep -oP '"version"\s*:\s*"\K[^"]+' 2>/dev/null) || true
fi

# Method 2: Parse firmware version from login page
if [[ -z "${VERSION}" ]]; then
  RESP=$(curl -sk --connect-timeout 10 "https://${TARGET}/" 2>/dev/null) || true
  VERSION=$(echo "$RESP" | grep -oP 'LoadMaster\s+v?\K[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' 2>/dev/null | head -1) || true
fi

if [[ -z "${VERSION}" ]]; then
  echo "[!] Could not determine LoadMaster firmware version."
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Detected firmware: ${VERSION}"

# Determine branch (GA vs LTSF) and set fixed version
if echo "$VERSION" | grep -qP '^7\.2\.5[0-9]'; then
  BRANCH="LTSF"; FIXED="$FIXED_LTSF"
elif echo "$VERSION" | grep -qP '^7\.2\.6[0-9]'; then
  BRANCH="GA"; FIXED="$FIXED_GA"
else
  echo "[!] Unrecognized firmware branch: ${VERSION}"
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Branch: ${BRANCH} - Fixed in: ${FIXED}"

if ver_gte "$VERSION" "$FIXED"; then
  echo "[+] Firmware ${VERSION} >= ${FIXED}"
  echo "PATCHED"
  exit 0
else
  echo "[-] Firmware ${VERSION} < ${FIXED} - AFFECTED by CVE-2026-8037"
  # Probe whether the vulnerable endpoint is reachable
  HTTP=$(curl -sk --connect-timeout 5 -o /dev/null -w "%{http_code}" \
    "https://${TARGET}/accessv2" 2>/dev/null) || HTTP="000"
  if [[ "$HTTP" != "000" ]]; then
    echo "[!] WARNING: /accessv2 reachable (HTTP ${HTTP}) - exploit path OPEN"
  else
    echo "[*] /accessv2 not reachable from this host - management segmentation may be in place"
  fi
  echo "VULNERABLE"
  exit 1
fi