Vulnerabilities
Kemp LoadMaster Uninitialized Memory RCE - CVE-2026-8037
Progress Software’s Kemp LoadMaster is vulnerable to a remote code execution flaw in the escape_quotes function. The issue requires authentication and allows attackers to run code as root. Apply the vendor patch immediately and verify configuration hardening.
What happened
A flaw in the escape_quotes function of Progress Software’s Kemp LoadMaster allows authenticated attackers to execute arbitrary code with root privileges. The vulnerability stems from uninitialized memory usage and is identified as CVE-2026-8037 with a CVSS score of 7.2.
Impact
Any installation that has not applied the vendor’s patch is susceptible. Successful exploitation grants full system control to the attacker, enabling data exfiltration, persistence, or further lateral movement.
What to do
- Apply the latest security bulletin released by Progress Software.
- Verify that the escape_quotes functionality is disabled or patched on all LoadMaster instances.
- Restrict administrative access to trusted IP ranges and enforce multi‑factor authentication.
- Monitor logs for anomalous use of the escape_quotes endpoint and unexpected root‑level activity.
Related vulnerabilities
Chromium CVE-2026-95324: Uninitialized GPU Resource Vulnerability
A flaw in Chromium’s GPU handling allows an attacker to exploit an uninitialized resource, potentially leading to memory corruption or arbitrary code execution. Microsoft Edge, built on Chromium, incorporates the same fix, so updating to the latest Edge version mitigates the risk. Defenders should verify Edge is current and monitor GPU activity for anomalies.
Read briefing
Microsoft Edge Addresses CVE-2026-95332: Uninitialized Variable in Tint
A recent CVE (CVE‑2026‑95332) in Chromium’s Tint component could allow memory corruption via an uninitialized variable. Microsoft Edge (Chromium‑based) has incorporated the fix. Defenders should verify that Edge is updated to the latest release and monitor for related alerts.
Read briefing
Oracle VirtualBox VirtioSCSI Uninitialized Memory Disclosure – CVE‑2026‑71132
A flaw in VirtualBox’s VirtioSCSI driver lets a local attacker with high‑privileged guest code read hypervisor data. Oracle has released a patch; defenders should update immediately and review guest privilege levels.
Read briefing
Citrix NetScaler RCE Vulnerability (CVE‑2026‑107406) Requires Immediate Patch
Citrix has disclosed a critical memory‑overflow flaw in NetScaler ADC and Gateway appliances that can be leveraged for remote code execution or denial‑of‑service when configured as a SAML IdP or SP. Affected systems must be upgraded to the latest patched releases without delay. No active exploits reported yet, but defenders should verify patch status and monitor traffic.
Read briefing