Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts

A critical unauthenticated command injection vulnerability in Progress Kemp LoadMaster (CVE-2026-8037) has been actively exploited nearly 800 times across dozens of countries before receiving a federal patching mandate. The flaw requires no credentials, meaning any internet-exposed instance is a viable target for full system compromise. This incident highlights the persistent danger of delaying patches on internet-facing network infrastructure, which often receives less scrutiny than endpoint or server assets. The volume of exploit attempts from 65 distinct IP addresses across 18 countries indicates coordinated, widespread scanning by threat actors — a pattern that typically accelerates once a vulnerability is publicly disclosed. Federal agencies and private organizations alike must treat load balancers and similar appliances as high-priority patching targets, not afterthoughts.