Pre-Auth RCE in Progress Kemp LoadMaster
Attack Techniques & Methods2026-07-03, 07:29
WatchTowr Labs has published an in-depth technical analysis of CVE-2026-8037 — a pre-auth remote code execution vulnerability in the API component of the Progress Kemp LoadMaster load balancer.
Entry point:
POST /accessv2 HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Length: 2986
Host: 192.168.5.30:443
Content-Type: application/json
Accept: /
Connection: keep-alive
{"cmd": "getall", "apiuser": "AAAAAA", "apipass": "BBBBBB"}```
In vulnerable versions (`GA v7.2.63.1` and earlier, `LTSF v7.2.54.17` and earlier), the function `escape_quotes()` in `/accessv2`:
- allocates a buffer via `malloc()`, and the memory is not zero-initialized
- does not append `\0` to the resulting string, allowing reads beyond the buffer boundary.
As a result, supplying the payload `"apiuser":"''''"` leads to full pre-auth remote code execution as root on a device typically exposed at the network perimeter.
The issue was fixed in version `7.2.63.2` and later. The patch replaced `malloc` with `calloc` and added `end = 0`, eliminating the use of uninitialized memory and preventing data leakage.
Article: https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/Vulnerabilities
Researchers
Vendors
Products