As reported by BleepingComputer, CISA has added a critical Progress Kemp LoadMaster vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming that threat actors are actively leveraging this flaw in real-world attacks. For organizations depending on LoadMaster as their application delivery controller (ADC), this is not a drill — it is an active incident waiting to happen.
Vulnerability At a Glance
- CVE ID
- CVE-2024-7591
- Severity
- Critical — CVSS Score 10.0
- Vulnerability Type
- OS Command Injection via improper input validation in the management interface
- Affected Product
- Progress Kemp LoadMaster (all versions prior to the patched release)
- Vendor
- Progress Software
- Patch Available
- Yes — Progress released a fix; update to the latest patched version immediately
- Active Exploitation
- Confirmed — added to CISA KEV catalog
Why This Vulnerability Is Particularly Dangerous
ADC appliances like LoadMaster occupy an extraordinarily privileged position in enterprise network architecture. They sit at the edge, proxying and load-balancing traffic for critical applications — often including customer-facing web portals, internal APIs, and enterprise SaaS integrations. A successful command injection attack against the management interface can give an attacker operating system-level code execution without requiring authentication on vulnerable configurations.
A CVSS score of 10.0 is the ceiling — it represents a network-exploitable, low-complexity, no-privilege-required, no-user-interaction vulnerability with a complete impact across confidentiality, integrity, and availability. In practice, this means automated exploitation is trivial, and opportunistic threat actors — not just sophisticated APT groups — are almost certainly scanning for exposed instances right now.
Shield53 Perspective: ADC and load balancer appliances are chronically under-patched in enterprise environments. Security teams often treat them like networking hardware rather than software requiring a vulnerability management lifecycle. This is a costly assumption — and one that threat actors are actively capitalizing on.
Who Is Most at Risk?
Broader Implications: The ADC Attack Surface Problem
This incident is part of a troubling and accelerating trend. Over the past two years, critical vulnerabilities in edge appliances — Ivanti Connect Secure, Citrix NetScaler, Palo Alto Networks PAN-OS, and now Progress LoadMaster — have become primary initial access vectors for both ransomware groups and nation-state actors. These devices are attractive targets because they are network-adjacent, often poorly monitored, and frequently excluded from standard endpoint detection and response (EDR) coverage.
The addition to CISA's KEV catalog triggers a mandatory 72-hour remediation deadline for U.S. federal civilian executive branch (FCEB) agencies under Binding Operational Directive 22-01. However, all organizations — public and private — should treat the KEV catalog as an authoritative signal of real-world risk, not a compliance checkbox relevant only to government entities.
Shield53 Recommendations — Immediate Actions
1. Emergency Patch Deployment
- Identify all Progress Kemp LoadMaster instances in your environment immediately, including those managed by third parties or MSPs
- Apply the vendor-issued patch to all affected appliances without waiting for your next scheduled maintenance window — this warrants an emergency change
- Verify patch integrity and confirm successful installation via the LoadMaster management console
2. Restrict Management Interface Access — Now
- If patching cannot occur immediately, restrict access to the LoadMaster management interface to trusted administrative IP ranges only
- The management interface should never be exposed to the public internet — verify this in your firewall rules immediately
- Implement multi-factor authentication on any remaining administrative access paths
3. Hunt for Indicators of Compromise
- Review LoadMaster management interface access logs for anomalous commands, unusual IP sources, or access outside business hours
- Look for unexpected outbound connections, new user accounts, or modified configurations that could indicate post-exploitation persistence
- Engage threat hunting resources if your environment has been running a vulnerable version with an exposed management interface
4. Update Your Appliance Vulnerability Management Program
- Ensure network appliances and ADCs are included in your vulnerability scanning and patch management lifecycle — not treated as set-and-forget infrastructure
- Subscribe to Progress Software security advisories and CISA KEV alerts for ongoing awareness
The window between public disclosure and mass exploitation for critical ADC vulnerabilities is now measured in hours, not weeks. Organizations that treat this alert as routine will find themselves on the wrong side of that timeline.
