Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre

CVE-2024-1212 is a critical (CVSS 9.8) unauthenticated OS command injection flaw (CWE-78) in the management interface of Progress Kemp LoadMaster, a load balancer / application delivery appliance. A remote attacker with no credentials can send crafted requests to the management interface, causing the appliance to execute arbitrary operating system commands; security reporting indicates commands can be run with root privileges. Successful exploitation gives attackers full control of the appliance and potential access to the backend servers and traffic it manages. Any organization running an affected Kemp LoadMaster appliance or virtual appliance whose management interface is reachable is exposed. Exploitation is occurring in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-11-18, carries a 95.4% EPSS probability of exploitation within 30 days, and recent headlines report active exploitation attempts.

Do: Apply the vendor-supplied update immediately per Progress's advisory (the CISA KEV required action is to apply vendor mitigations or discontinue use of the product), since no public PoC is needed for attackers to exploit it. Until patched, restrict the LoadMaster management interface (web UI and API) to trusted management networks behind a firewall or VPN, and review appliance logs for signs of unauthenticated access or unexpected command execution. Treat any suspected compromise as high risk, as ransomware use is currently unknown.

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0.

Progress Kemp LoadMaster, the application delivery controller/load balancer sold by Progress Software (formerly Kemp), contains an unauthenticated OS command injection flaw (CWE-77) in its API: unsanitized input sent to multiple command endpoints allows arbitrary operating-system commands to be executed on the appliance. Because the affected endpoints require no authentication, any remote attacker with network access to the appliance's API or management interface can trigger the bug directly; public research by WatchTowr describes it as a pre-authentication RCE chain (involving uninitialized memory/quote handling) that can yield root-level command execution. Successful exploitation gives an attacker full control of the appliance, consistent with the Critical 9.8 CVSS 3.1 score (network-exploitable, no privileges or user interaction, high impact on confidentiality, integrity and availability). Organizations running Progress Kemp LoadMaster appliances are affected, especially those where the management or API interface is reachable from the internet. Exploitation is confirmed and ongoing: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-08-07 after 792 reported exploit attempts, and EPSS assigns a 99.6% probability of exploitation within 30 days.

Do: Upgrade LoadMaster to the fixed release identified in Progress's security advisory (fixed version numbers are not specified in this data). Until patched, restrict the LoadMaster API/management interface to trusted networks or VPN access, and review appliance logs for signs of unexpected command execution given confirmed in-the-wild exploitation. Because the flaw is on CISA's KEV catalog, US federal agencies must apply mitigations per BOD 26-04 by the required deadline — or discontinue use of the product if mitigations are unavailable — and evaluate each asset's internet exposure.