A critical pre-authentication remote code execution (RCE) vulnerability (CVE-2026-8037, CVSS 9.6) in Progress Kemp LoadMaster is now actively being exploited. eSentire’s Threat Response Unit has observed attempts to leverage this OS command injection flaw. Organizations using Kemp LoadMaster should apply patches immediately to prevent attackers from gaining control of their systems.