CISA Warns of Active Exploitation in Progress LoadMaster Vulnerability

Technical Impact and Exploitation Scenarios The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory regarding a critical vulnerability in Progress LoadMaster, formerly known as Kemp LoadMaster. This flaw, tracked as CVE-2024-7591, has a near-perfect CVSS score of 10.0, indicating the highest level of severity. The vulnerability is an unauthenticated remote command execution (RCE) flaw, which allows an attacker to send specially crafted requests to the LoadMaster management interface to execute arbitrary commands on the underlying operating system. CISA has recently added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming that threat actors are actively leveraging this weakness in the wild to compromise organizational networks. This makes immediate patching a matter of national and corporate security. The core issue lies in how the LoadMaster appliance processes HTTP requests. Because the vulnerability can be exploited without any valid credentials, it serves as an ideal entry point for ransomware groups and state-sponsored actors. Once an attacker gains RCE on a load balancer, they occupy a strategic position in the network. Load balancers often sit at the edge, handling traffic for multiple internal applications and possessing access to SSL certificates and sensitive backend configurations. From this vantage point, an adversary can intercept traffic, steal session tokens, or move laterally into deeper segments of the corporate network. ## Mitigating the LoadMaster Flaw FORTSECURE GLOBAL strongly recommends that all organizations utilizing Progress LoadMaster appliances immediately update to the latest firmware versions provided by the vendor. If immediate patching is not possible, organizations should implement strict access control lists (ACLs) to ensure that the management interface is not reachable from the public internet. Access should be restricted to trusted administrative IP addresses only, preferably behind a VPN. Additionally, security teams should conduct a thorough review of system logs for any signs of unauthorized command execution or unusual administrative logins dating back to the vulnerability's disclosure. Continuous monitoring of outbound traffic from the appliance can also help detect potential beaconing to command-and-control (C2) servers.

---

แหล่งที่มา: SecurityWeek เผยแพร่ครั้งแรก: Mon, 10 Aug 2026 09:31:51 +0000 บทความต้นฉบับ: อ่านต้นฉบับ