Progress LoadMaster command injection flaw actively exploited (CISA KEV)

Mon, 10 Aug 2026 11:57:16 +0000

Engineer — Act: CISA has flagged active exploitation of this critical command injection flaw in Progress Kemp LoadMaster; patch to the latest fixed version immediately and audit LoadMaster logs for signs of prior compromise.
SOC/IR — Act: Edge device under active exploitation warrants an assume-breach posture — sweep LoadMaster access logs for anomalous commands or unexpected outbound connections since the vulnerability was disclosed, and tune detections on traffic originating from load balancer management interfaces.
Leader — Plan: Confirm whether LoadMaster is deployed anywhere in the environment and verify your engineering team has prioritized patching; this is not yet a board-level systemic event but CISA active-exploitation designation means it should be on the remediation radar this week.

Progress-Loadmaster on CuraSec