LoadMaster Critical Security Bulletin – June 2026 – (CVE-2026-8037, CVE-2026-33691)

The Progress Kemp LoadMaster team recently confirmed one critical-severity and one high-severity vulnerability in Progress Kemp LoadMaster: GA v7.2.63.1 and older, and LTSF v7.2.54.17 and older (CVE-2026-8037, CVE-2026-33691). We have addressed the issues and have developed and tested a patch that is now available. Currently, we have not received any reports that this vulnerability has been exploited, and we are not aware of any direct operational impact to customers.

Jul 31, 2026
Knowledge

Title

URL Name

LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691

Article Number

000301124

Information

(Critical severity) CVE-2026-8037 - Command Injection Remote Code Execution Vulnerability

OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an unauthenticated attacker with permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input.

(High severity) CVE-2026-33691 - OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks

The OWASP Core Rule Set failed to normalize whitespace in filenames before applying the extension‑checking regular expression

What are the impacts? 

If someone were to exploit this vulnerability, the following could happen:

An unauthenticated attacker could execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized API inputs.

Specially crafted HTTP multipart requests containing an encoded malicious payload could bypass WAF detection on the LoadMaster appliance.

Note that there are no known indicators of compromise at this time.

Affects: 

Kemp LoadMaster: GA v7.2.63.1 and older

Kemp LoadMaster: LTSF v7.2.54.17 and older

 
If you have any questions or concerns related to this issue, please log in to open a Technical Support case. Technical Support is available to Progress Kemp LoadMaster customers under warranty and active maintenance. If your model is no longer supported as part of the Product Lifecyle Policy, you should upgrade to a supported model.

What action do I need to take? 

We have addressed the vulnerability, and the Progress Kemp LoadMaster team strongly recommends performing a firmware upgrade to the latest version listed in the table below. 

For all customers on a current maintenance agreement, the upgrade can be accessed via the Download Hub or by clicking on one of the links below. Customers that are not on a current maintenance agreement should contact a Progress Sales Representative or their respective Partner.
 
To confirm your current version of  Progress Kemp LoadMaster, please log into the web UI and find the version string in the top-right corner or look at the console after booting the appliance to find version information.

Vulnerable Version	Fixed Version(s)	Documentation
Progress Kemp LoadMaster GA v7.2.63.1 and all prior versions	Progress Kemp LoadMaster GA v7.2.63.2 XML Checksum verification file	Link to documentation
Progress Kemp LoadMaster LTSF v7.2.54.17 and all prior versions	Progress Kemp LoadMaster LTSF v7.2.54.18 XML Checksum verification file
Progress ECS Connection Manager v7.2.63.1 and all prior versions	Progress ECS Connection Manager v7.2.63.2 XML Checksum verification file
Progress Connection Manager for ObjectScale v7.2.63.1 and all prior versions	Progress Connection Manager for ObjectScale v7.2.63.2 XML Checksum verification file

 
Additional Information 

To receive email notifications for Product and Security Updates like this, please log into the Progress Community Portal and sign up for our Progress Alert and Notification Service (PANS).

Please see our FAQ page regarding Frequently Asked Questions (FAQ) for Progress Alert Notifications (PANS).

Additional Information

Environment

Last Modified Date

7/31/2026 8:24 PM

Disclaimer

Defect Number