Sibi SP (Customer) asked a question.

July 20, 2026 at 6:01 AM
My customer has got Virtual Loadmaster 500/1G and the WAF version is 7.2.60.0.22520.RELEASE with OWASP CRS 3.3.5. Now they have queries with respect to UAE Cybersecurity notice referring to CVE-2026-52761 & 52747.

Since the Cyber Security Council advisory refers to OWASP ModSecurity WAF vulnerabilities, and Kemp LoadMaster bundles the WAF/ModSecurity engine within the LoadMaster firmware, would appreciate your support in validating the following:

  • Whether our current LoadMaster version (7.2.60.0.22520.RELEASE) is affected by the reported ModSecurity WAF vulnerabilities.
  • Whether the built-in Kemp WAF engine in our version uses an affected ModSecurity component.
  • The recommended fixed LoadMaster firmware version for our environment.
  • Assistance with planning and performing the firmware upgrade, preferably to the latest supported security-fixed release.
  • Confirmation on whether a WAF Ruleset/OWASP CRS update is also required following the firmware upgrade.

 

  • 12 answers
  • 398 views

  • Andrew Howe (Progress Kemp)

    Hi @Sibi SP (Customer)​,

     

    OWASP CRS (WAF) developer here.

     

    Firstly, let me assure you that Progress Kemp LoadMaster is not affected by the vulnerabilities you mentioned. Both CVE-2026-52747 and 2026-52761 affect software components that are not used or included in LoadMaster, therefore LoadMaster is unaffected by these issues.

     

    Secondly, the LoadMaster version you mentioned (7.2.60) is somewhat old and not the current or most up to date version. The current GA release of LoadMaster is 7.2.63.2. Between v7.2.60 and v7.2.63.2 there have been many security and bug fixes, including to the built-in WAF system. (Please refer to our security bulletins from April and June as well as our overview table on this page for details on the fixed WAF issues.) I would strongly suggest that you update to get all of the latest fixes.

     

    I hope this info helps. Please let me know if you have any further questions.

     

    Thanks,

    Andrew

    Selected as Best

  • Andrew Howe (Progress Kemp)

    Hi @Sibi SP (Customer)​,

     

    OWASP CRS (WAF) developer here.

     

    Firstly, let me assure you that Progress Kemp LoadMaster is not affected by the vulnerabilities you mentioned. Both CVE-2026-52747 and 2026-52761 affect software components that are not used or included in LoadMaster, therefore LoadMaster is unaffected by these issues.

     

    Secondly, the LoadMaster version you mentioned (7.2.60) is somewhat old and not the current or most up to date version. The current GA release of LoadMaster is 7.2.63.2. Between v7.2.60 and v7.2.63.2 there have been many security and bug fixes, including to the built-in WAF system. (Please refer to our security bulletins from April and June as well as our overview table on this page for details on the fixed WAF issues.) I would strongly suggest that you update to get all of the latest fixes.

     

    I hope this info helps. Please let me know if you have any further questions.

     

    Thanks,

    Andrew

    Selected as Best

    • Sibi SP (Customer)

      Hi Andrew Howe,

       

      Thank you very much for your prompt reply.

       

      Can you suggest the upgrade path as well from 7.2.60.0 to 7.2.63.2 please. Can we directly upgrade to the target version or is it a step-by-step procedure? Please recommend.

       

      Thanks again

       

      Sibi

      • Andrew Howe (Progress Kemp)

        Hi @Sibi SP (Customer)​,

         

        You can update directly from 7.2.60 to the latest GA version, 7.2.63.2 (reference).

         

        I will reach out directly with additional info on updating.

         

        Thanks,

        Andrew

      • Sibi SP (Customer)

        Hi @Andrew Howe (Progress Kemp)​ ,

         

        Can you confirm which is the latest version to be updated to.

         

        Is it 7.2.63.2 or 7.2.63.3?

         

        What are the precautions to be taken while updating version in Virtual Loadmaster HA config?

         

        Thanks in advance.

         

        Regards

        Sibi

         

  • Sibi SP (Customer)

    Hi @Andrew Howe (Progress Kemp)​ ,

     

    Now my customer came up with another concern as below;

     

    " We have now started observing kernel filesystem errors on the appliance, and to investigate and advise on the issue below:

    lb100 kernel: EXT2-fs (hda2): error: ext2_lookup: deleted inode referenced: 29

    As this may indicate a filesystem inconsistency or storage-related issue, we would appreciate your urgent assessment and recommendations, including whether this could be related to the firmware version currently running on the appliance."

     

    Is this something related to the existing non-upgraded version of firmware or else, what could be the reason?

     

    Thanks in advance for your support.

     

    Regards

    Sibi

    • Andrew Howe (Progress Kemp)

      Hi @Sibi SP (Customer)​,

       

      As this new query is quite technical, I think that would be best addressed through the Support Team by an engineer.

       

      Would you / your customer be able to open a technical support case for this new issue?

       

      Please let me know if I can help with this.

       

      Thanks,

      Andrew

  • Andrew Howe (Progress Kemp)

    Hi @Sibi SP (Customer)​ ,

    Checking back in: did this get resolved?

    Let me know if I can help.

    Thanks,

    Andrew.

    • Sibi SP (Customer)

      Hi @Andrew Howe (Progress Kemp)​ ,

      Thanks for asking.

      We did upgrade the firmware in both units and cleared the mentioned error also during a scheduled session on last Saturday evening. However, customer has reverted with another error (screenshot below) and we are looking into the same now.

10 of 12