decrypted · 9 august 2026 · vulnerabilities and patching · uk policy and law · digital sovereignty

The Kemp LoadMaster bug at your network's edge, and the API that didn't need to be on

A load balancer sits at the one place in a network that has to talk to the whole internet, so when one turns out to have an unauthenticated route to running commands as root, it stops being a niche appliance story and becomes everyone's problem. On Friday CISA added CVE-2026-8037, a critical flaw in Progress's Kemp LoadMaster, to its Known Exploited Vulnerabilities catalogue, and telemetry now shows 792 exploitation attempts over 41 days from 65 IP addresses in 18 countries. Federal US agencies have until Monday to patch. UK organisations running LoadMaster do not have that deadline, which is precisely why this is worth five minutes now rather than after the fact.

What actually broke

LoadMaster's job is to sit in front of your applications and decide which backend server handles each request, along with the SSL work and a bit of web application firewalling on top. Somewhere inside it is a function called escape_quotes(), whose entire purpose is to strip anything dangerous out of user input before it reaches a shell command, the digital equivalent of a bag search before you're let backstage. Researchers at watchTowr Labs found that this function allocated its scratch memory with malloc() rather than the zeroed calloc(), and then failed to mark where the cleaned-up text actually ended. Feed it a very particular flood of extra characters and quote marks and you can make it read leftover data from memory that was never meant to be there, and steer that leftover data into the shell command it's about to run. The security guard's bag scanner reads someone else's forgotten luggage tag as your boarding pass.

The route in is an API endpoint, /accessv2, and it's only reachable when LoadMaster's API feature is switched on. Progress patched this in June, watchTowr published the technical write-up on 29 June, and attackers were testing it within hours.

The Secure by Design lesson

The fix that would have prevented every one of those 792 attempts already exists in the product: leave the API turned off unless you specifically need it. That's the whole of Secure by Design in one sentence, ship the risky feature disabled and make the customer opt in with their eyes open, rather than shipping it live and hoping nobody scans for it. A load balancer's management API is not something most deployments need exposed to the internet at all, let alone by default. For any UK organisation running LoadMaster, or any similar edge appliance, the practical task this week is boring but concrete: check whether that API is on, whether it needs to be, and whether it's reachable from outside your network if so. If watchTowr's researchers could turn a two-line memory bug into root access in a fortnight, so can whoever is behind those 65 IP addresses.

Also this week

Switzerland's federal IT office confirms a SharePoint breach. Around 200 accounts at Switzerland's Federal Office for Information Technology, Systems and Telecommunication were compromised after attackers exploited one of two SharePoint flaws patched in July, CVE-2026-56164 or CVE-2026-50522. The agency says no confidential data has surfaced, but it's now rebuilding the affected servers from scratch rather than trust a patched-in-place system. On-premises SharePoint remains common across UK local government and universities; if your July patching queue still has a SharePoint entry in it, this is the week it stops being theoretical.

The ICO reprimands the Met Police over two unrelated disclosures. A stalking victim's new address and phone number were served, unredacted, to the man subject to a protection order against her, who then contacted her on the new number within days. Separately, an officer emailed 18 people connected to a Westminster investigation using "To" instead of "BCC". The ICO found both stemmed from the same root cause: mandatory data protection training going uncompleted for years, with nobody checking. The Met now has to hit 100% training completion and report progress quarterly. It's a reminder that the least glamorous control, whether anyone actually did the training, is often the one holding everything else up.

The MoD hands Microsoft a two-year, £13.3 million threat intelligence contract, unopposed. Defence Digital awarded access to the Microsoft Threat Analysis Centre, covering nation-state cyber threats and influence operations, through a restricted procurement in which Microsoft was the only bidder. There's nothing improper about that, but a single-vendor process for a capability this sensitive is exactly the kind of concentration UK sovereignty debates keep circling back to.

Sources

Working through your own edge infrastructure or vendor exposure? get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.

Play here Loads Apple's player when you press it.