ZDI-26-646: Progress Software Kemp LoadMaster escape_quotes Uninitialized Memory Remote Code Execution Vulnerability
ZDI publishes ZDI-26-646 for CVE-2026-8037, an authenticated uninitialized-memory remote code execution flaw in Progress Kemp LoadMaster, rated CVSS 7.2.
Zero Day Initiative published advisory ZDI-26-646 describing an uninitialized memory flaw in Progress Software Kemp LoadMaster's escape_quotes function. Successful exploitation allows remote authenticated attackers to execute arbitrary code on affected installations. ZDI rated the issue CVSS 7.2 and assigned CVE-2026-8037.
- Uninitialized memory in escape_quotes allows arbitrary code execution
- Authentication is required to exploit the flaw
- CVSS 7.2; tracked as CVE-2026-8037
- CVEs
- CVE-2026-8037
- Vendors
- Progress Software
- Products
- Kemp LoadMaster
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-8037 | Unauthenticated OS Command Injection RCE in Progress Kemp LoadMaster | 9.8 | 100% | KEVPoC | KEV |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.