The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that threat actors are actively exploiting a critical pre-authentication OS command injection vulnerability affecting Progress Kemp LoadMaster and several related products. The flaw, tracked as CVE-2026-8037, stems from improper handling of user-controlled API input and an uninitialized heap buffer, allowing an unauthenticated remote attacker to manipulate memory and ultimately execute arbitrary commands with root privileges. Affected products include LoadMaster GA 7.2.63.1 and earlier, LTSF 7.2.54.17 and earlier, MOVEit WAF versions prior to GA 7.2.63.2, ECS Connection Manager, and Connection Manager for ObjectScale, with Progress releasing patches in June. Exploitation activity emerged shortly after watchTowr published technical details and proof-of-concept code on June 29, and eSentire reported attempted exploitation beginning the following day, although the earliest observed attempts were unsuccessful. The vulnerability poses significant risk because LoadMaster appliances are frequently positioned at the network edge and provide visibility into critical internal services, potentially allowing successful attackers to establish initial access and conduct further malicious activity. With more than 100,000 LoadMaster deployments worldwide and Shadowserver tracking nearly 300 internet-exposed instances, the attack surface spans major enterprises and government organizations. On August 7, CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to remediate the vulnerability within just three days. CTIX analysts urge all organizations running affected products to prioritize patching.