Kemp LoadMaster Has a Pre-Auth RCE. Four Quotes Can Open a Root Shell

• The Mess: Progress Kemp LoadMaster contains CVE-2026-8037, a command-injection chain in the appliance API that can lead to remote code execution. Public research shows the attack can reach the device without authentication and execute commands as root.
• The Damage: A vulnerable load balancer sits directly on the network edge, so a successful exploit can turn traffic infrastructure into a root-level foothold.
• The Fix: Upgrade LoadMaster to 7.2.63.2 or later or the applicable fixed LTSF release and restrict management/API exposure immediately.

The Sanitizer Was the Problem

CVE-2026-8037 is the kind of vulnerability that makes security engineers stare at the code and ask one question:

Why is a function called escape_quotes() helping an attacker execute shell commands?

The vulnerable LoadMaster code takes API input, passes it through escape_quotes(), constructs a shell command and eventually reaches system().

The escaping function had two memory-safety problems: it allocated memory with malloc() without clearing it and failed to properly terminate the resulting string.

The security function became the attack primitive.

Four Quotes Are Enough to Start the Chain

The interesting payload abuses single quotes in the apiuser field.

Research published by WatchTowr showed that a specially crafted value containing four single quotes can manipulate the vulnerable heap state. Additional attacker-controlled JSON fields can then be used to influence memory around the vulnerable allocation.

The final payload reaches a shell command.

And the shell doesn’t care that the input originally came from a login API.

Once attacker-controlled data reaches system(), the game is over.

This Is Not Just a Crash

CVE-2026-8037 was originally split across several vulnerable functions in the LoadMaster API. ZDI lists remote code-execution issues involving apiuser, dodelapikey and dolistapikeys, all tracked under the same CVE.

The most dangerous analysis shows the chain reaching pre-authentication command execution as root.

That distinction matters.

An attacker doesn’t need to steal an administrator password first.

The management API itself becomes the entry point.

The Appliance Is the Worst Possible Target

Kemp LoadMaster isn’t a random application server.

It’s an ADC and load-balancing platform sitting in front of other systems.

That makes compromise particularly valuable.

An attacker controlling the appliance can potentially:

• inspect network traffic
• alter traffic handling
• access configuration data
• establish persistence
• pivot toward internal systems
• attack applications behind the load balancer

The edge device becomes the foothold.

Everything behind it becomes more interesting.

The PoC Changed the Risk

WatchTowr published a detailed technical analysis showing how the vulnerable code can be turned into command execution. Security researchers subsequently documented exploitation attempts against exposed LoadMaster systems.

This is no longer a vulnerability that defenders can safely classify as “theoretical.”

A public exploit path against an Internet-facing network appliance changes the response priority.

Especially when the end result is root.

Check the API

There is an important deployment detail.

The vulnerable attack path requires the relevant LoadMaster API to be enabled. Systems with the API disabled are not exposed through this particular vector.

That does not mean administrators should simply assume they are safe.

Verify the configuration.

Check whether the management interface or API is reachable from untrusted networks.

Then patch anyway.

Progress lists 7.2.63.2 as the fixed GA release, with corresponding fixes for supported LTSF branches.

Hunt Before You Patch

If an exposed LoadMaster was running a vulnerable version, don’t treat the upgrade as the end of the incident.

Look for:

• unexpected API requests
• repeated authentication attempts containing unusual quote characters
• unexpected configuration changes
• new administrative activity
• suspicious outbound connections
• unknown processes
• unexplained changes to scripts or system files

The vulnerable code path can produce exploitation attempts that look like malformed authentication requests rather than a conventional login.

That makes API logs worth keeping.

Bugstoday Opinion

This is a particularly stupid way to lose a perimeter appliance.

The function was called escape_quotes().

Its job was to make dangerous input safe.

Instead, broken memory handling turned it into a path toward system() and eventually root.

That’s the kind of bug that should make every vendor ask whether they are still building shell commands from network input in the first place.

A load balancer is supposed to distribute traffic.

Not distribute root shells.

Today’s Bugs. Tomorrow’s Breaches.

Technical Sources

Progress Software — LoadMaster Security Updates
Trend Micro Zero Day Initiative — CVE-2026-8037
WatchTowr Labs — CVE-2026-8037 Technical Analysis
CVE.org — CVE-2026-8037
CISA Known Exploited Vulnerabilities Catalog