The Kemp LoadMaster Exploit and the First Attack Landed on the Same Day. CISA Catalogued It 39 Days Later, and Federal Agencies Got a Long Weekend.

CISA added CVE-2026-8037 to the Known Exploited Vulnerabilities catalogue on 7 August. It is an unauthenticated command injection in Progress Kemp LoadMaster, CVSS 9.6, letting an attacker run arbitrary commands on the appliance through unsanitised input across several endpoints.

A load balancer is a reasonable thing to want command execution on. It sits in front of the applications, terminates the TLS, and can see the traffic.

The dates are the story here, so let us lay them out.

Twenty-five quiet days, then nothing

Progress disclosed the flaw and shipped a patch on 4 June.

A functional proof of concept went public on 29 June. eSentire's Threat Response Unit observed exploitation attempts beginning that same day.

Not a week later. Not after the technique matured. The same day. Their telemetry records 792 attempts from 65 distinct source addresses across 41 days.

Sixty-five distinct addresses is the detail that tells you what kind of event this is. One actor probing looks like one or two addresses. Sixty-five is a field — commodity scanning, opportunists, everyone who watches exploit repositories with automation. That is what publishing working code produces, and it produces it immediately.

Which means the twenty-five days between disclosure and public exploit were the entire window. That stretch is the whole product of coordinated disclosure: a period when patching is cheap and nothing is hunting you. It does not taper off. It ends on a specific afternoon when somebody pushes to GitHub.

The catalogue arrived thirty-nine days into the exploitation

CISA listed it on 7 August. Exploitation started 29 June.

Federal civilian agencies now have until 10 August under Binding Operational Directive 26-04 — three days to remediate a vulnerability that has been actively exploited for nearly six weeks.

We are not knocking CISA. KEV is one of the genuinely useful things in this industry and its evidentiary bar exists for good reason: a catalogue that lists rumours is worth nothing. But a great many organisations have quietly wired KEV into their patch prioritisation as the trigger rather than as the confirmation, and for this CVE that meant thirty-nine days of treating an actively exploited pre-auth command injection as routine.

KEV is a lagging record of what already happened to somebody else. It is excellent as an audit backstop and dangerous as your first alert.

Our receipt, with the comparator next to it

Our exploit-harvester pulled the proof-of-concept repository, Caster-chen/CVE-2026-8037-POC, into our corpus on 9 July, corroborated the same day by our GitHub hunt. That is first-party collection — our own automation watching public repositories — not a third-party feed we re-ingested and relabelled.

CISA catalogued the CVE on 7 August.

So the exploit was in our corpus 29 days before it reached KEV.

Now the part we are obliged to say clearly, because we have got this wrong before and published a correction about it: that is not a claim that we found the exploit first. The PoC was public on 29 June. We collected it on 9 July, ten days behind the public drop. The research credit belongs to whoever wrote it, and the exploitation telemetry belongs to eSentire.

What the timestamp legitimately supports is narrower and still useful: if your vulnerability programme waits for KEV, twenty-nine days is the size of your blind spot on this particular CVE, and we can show you the exact artefact that was sitting in a corpus during it. We publish the comparator date beside our own precisely so you can check the arithmetic rather than take our word for it.

What to do about LoadMaster specifically

Patch it. The fix has existed since 4 June.

If you cannot patch immediately, get the management interface off the internet. This is the same advice we gave in our earlier post on the pre-auth root bug in LoadMaster, and it keeps being the advice because the management interface keeps being the way in. A load balancer's admin API has no business being reachable from arbitrary addresses, and almost every appliance compromise we write up runs through a management plane somebody left exposed for convenience.

Then check whether it already happened. You are looking for command execution artefacts on the appliance — unexpected processes, modified configuration, new accounts, outbound connections from a device that should mostly be receiving them. Appliances are the worst place to do forensics and the best place for an attacker to sit, because they are frequently outside EDR coverage entirely.

The generalisable bit

There is a measurable quantity here that we think deserves a name and a number: the gap between a patch being available and an exploit being public. Twenty-five days on this one. That is your real remediation SLA, and it is set by a stranger on the internet rather than by your change advisory board.

We built a detector for exactly this — weaponisation latency, correlating KEV entries against first observed public proof of concept and first observed probe. It found that fifteen of eighty-six recent KEV entries were already armed before CISA listed them. This CVE is now another instance of the same shape, and a particularly clean one because the PoC and the first attack share a date.

If you take one operational change from this post: stop treating catalogue listing as the signal to act, and start treating public exploit availability as the signal. The first is a lagging indicator maintained by an agency with an evidentiary standard. The second is the thing that actually changes your risk, and it changes it in an afternoon.

The accounting

Progress disclosed and patched. eSentire's Threat Response Unit did the exploitation telemetry — the 792 attempts and 65 source addresses are their numbers, not ours, and that kind of published detection data is what makes posts like this possible. CISA catalogued it. The Hacker News and Security Affairs reported it.

Our contribution is the collection timestamp, the arithmetic between the dates, and the argument about where in that sequence you should be acting.

We also want to credit the curation layer, because it is doing real work and rarely gets named. Our morning threat sweep reads five security feeds, and tl;dr sec (https://tldrsec.com) is one of them — Clint Gibler's newsletter is one of the better filters in this industry for separating research that matters from research that merely happened, and several items we have covered recently surfaced through it. If you are drinking from the same firehose we are, it is worth your inbox.

We guarantee five percent of what we publish is wrong. The likeliest five percent here is the precise attribution of "first exploitation" to 29 June — that is eSentire's first observation, and first observation is not the same as first occurrence. If somebody was exploiting this quietly before the PoC dropped, the twenty-five-day quiet window was shorter than we have drawn it, and the argument gets stronger rather than weaker.

---

Her name was Renee Nicole Good.

His name was Alex Jeffery Pretti.