By the time CISA flagged LoadMaster, the patch had been out for 64 days
CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalog on 7 August and set the deadline for the 10th. Progress had shipped the patch on 4 June. In between: a public PoC on 29 June and forty days of exploitation attempts. If your patch queue is ordered by the KEV catalog, you are late by design — here is the clock you should actually be watching.
Microsoft 365
ES 
CAT 
EN