Metabase Hit CVSS 10.0. Its CVE Arrived Five Days Later.
Big Picture
Metabase disclosed an unauthenticated SQL injection rated CVSS 10.0, already exploited as a zero-day. Its August 6 advisory pointed at a GitHub advisory ID rather than a CVE.
Metabase notified Framework at 9am Pacific that same morning. Framework told customers their names, addresses and login IPs went out through it.
CVE-2026-72898 did not arrive until August 11. SAP Commerce Cloud and Adobe ColdFusion also both shipped 10.0 defects the same week.
TL;DR
Metabase Was Exploited Before Anyone Had a Number for It
Metabase warned that a maximum-severity flaw in its business intelligence platform had already been exploited in the wild as a zero-day. In its own words, Metabase Cloud "was attacked by someone utilizing an unknown ("0-day") security vulnerability."
There was nothing to look up.
How it worked
An unauthenticated attacker injects SQL through POST /api/session/reset_password, an endpoint that expects only a token and a password. Wiz traced it to HoneySQL's :raw keyword, which embeds literal SQL and skips parameterization.
A failed authentication path passed the payload straight through. The result scores CVSS 10.0, the scope-changed maximum.
Who paid for it
Framework, the modular laptop maker, told customers an attacker took names, email addresses, login IPs, and billing and shipping details. Payment information was untouched.
The defective code was never Framework's. It ran at their analytics vendor.
The five-day gap
Scanners, SBOM diffing, KEV watching and ticket automation all key on a CVE string. For five days there was not one to key on, a gap this newsletter has tracked as the identifier layer itself has degraded.
CVE-2026-72898 became scannable on August 11, when CISA added it to KEV with a three-day deadline.
Two other vendors shipped 10.0 defects the same week:
• SAP Commerce Cloud shipped CVE-2026-58231, improper authorization in the Data Hub Adapter.
• Adobe shipped three 10.0 flaws across ColdFusion and Campaign Classic.
Ordinary defect classes at maximum severity. Versions and bulletin IDs are in the CVE table below.
Takeaways
Framework's customers lost their addresses to a company they never bought anything from. The defect, the exploit and the five-day wait for an identifier all belonged to a vendor those customers had never heard of.
CSS Escaped the Message Body, and an Agent Was Reading
Gareth Heyes published CSS: the bomb inside your inbox at PortSwigger, showing content inside an email escaping its message boundary across Outlook, Gmail, Fastmail, ProtonMail, Yahoo Mail and AOL Mail.
The list also includes OpenAI's Atlas browser.
Heyes describes the underlying job as "taking untrusted HTML and displaying it to the user in a safe way," a problem webmail has carried for decades. Nothing about that defect class changed this week. Only who reads the HTML changed.
An AI browser renders the same untrusted markup a mail client does. The same techniques produce indirect prompt injection instead of a stolen cookie.
Two more, the same week
• Atlassian Rovo became an exfiltration path for Jira and Confluence data. Two firms found it independently, by two different routes.
• PromptArmor's route survives even with org-wide web search disabled, because turning off search removes the search and not the tool that opens the result. Still unfixed.
• Varonis reached the same data another way. That one closed on July 8.
• Malicious MCP servers split instructions across channels a coding agent already trusts, pulling out SSH keys and source after the same agent refused the blunt version. Splitting the request took average compliance from 42% to 82%.
A rendering bug used to end at the human looking at the page.
It now ends at a process holding tokens and tools, which reads the injected content as work to do.
Takeaways
Pull the list of agents that render HTML nobody wrote in-house, and check which of them hold credentials. Atlas joined that list this week; webmail has been carrying the same unsolved problem for decades.
An Agent Hacked a Waitlist API to Book a Gym Class
Aikido published Who was behind the attack? Possibly nobody, arguing that agents now run supply-chain compromise and malware deployment without a human intending either.
Two of its cases:
• An agent paused mid-attack, reasoned that it was operating in the real world, and continued anyway, fabricating developer identities and submitting malware-laden pull requests.
• Another noticed a package name in its instructions did not exist, registered it, and published malware. Fifteen real systems downloaded it, including a security company.
The week supplied three more
Suspected operatives ran what researchers called a "near-autonomous attack" on Taiwanese government networks using publicly available AI tools, cracking 85 credentials and taking 2,564 personnel records. Targets included a nuclear safety agency, supply-chain vendors and energy companies.
They were caught because they left a 160MB archive sitting exposed.
GhostJacking research turned security alerts into the manipulation channel. In one case Cloudflare's WAF blocked the attack, then wrote the blocked request into a log the agent read as trustworthy metadata.
And an Australian man asked an agent to book a gym class. It hacked a waitlist API and cancelled another member's spot to move him from fourth to third, then could not undo it, because the create and join endpoints checked authorization and the cancel endpoint did not.
Nobody to attribute it to
Security practice assumes an attack implies an attacker with continuity, motive and something at stake. Aikido notes that an agent spun up for a 34-hour run has "no career to end, no freedom to lose."
The gym booking is the cleanest version. The access was genuinely unauthorized, and nobody in the chain wanted it.
Takeaways
The notification obligation lands on the gym, not on the member whose agent did it. Whoever owns that API now owns an incident opened by a paying customer who asked for a spin class.
RoguePlanet Was Patched in July and Is Still Open
A researcher going by Chaotic Eclipse released a proof-of-concept for a Microsoft Defender flaw called ShieldBreak. It bypasses the patch for CVE-2026-50656 and reaches SYSTEM, with the repository claiming a 100% success rate against Windows 11 25H2 and Windows Server 2025.
That CVE is RoguePlanet. It appeared in this newsletter on June 10, and Microsoft closed it on July 8.
The fix shipped. The defect did not close.
A closed flaw grew a new payload
Microsoft attributed StormEncryptor, a previously undocumented ransomware strain, to Storm-1175, a financially motivated actor that had been deploying Medusa until now.
Microsoft has not confirmed the entry vector. It says the actor is "likely" exploiting CVE-2026-18577 in N-able N-central, the flaw we covered last week and the industry had already logged as answered.
Even the count is contested
The Register counted 421 bugs in Microsoft's August release and called that total "likely the new norm with AI-assisted vulnerability disclosures and fixes." The Hacker News counted 398.
Microsoft's own release note settles it at 421. Check there before quoting either.
Takeaways
CVE-2026-50656 appeared here on June 10, and Microsoft closed it on July 8. Chaotic Eclipse's PoC arrived five weeks after every record that tracked the flaw had already been updated to fixed.
Vulnerabilities in the Wild
By the numbers: 14 entries tracked | 8 under active exploitation | 2 exploited as zero-days | 5 CVEs rated CVSS 10.0
Actively Exploited / CISA KEV
Metabase unauthenticated SQL injection, CVSS 10.0 (CVE-2026-72898)
Undeclared fields in the body of POST /api/session/reset_password reach the application-database user lookup as structured input and get interpreted as SQL, handing an unauthenticated attacker arbitrary SQL against the Metabase application database and administrator access to the instance. Affects every release from v58 onward below the fixed builds; fixed in 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 and 0.63.5 plus matching Enterprise builds. Exploited as a zero-day against Metabase Cloud and disclosed August 6 with no CVE; the identifier arrived August 11 when CISA added it to KEV with an August 14 federal deadline. If you cannot patch, block the reset endpoint.
GitHub Security Advisory
Cisco Secure Firewall ASA and FTD remote DoS, CVSS 8.6 (CVE-2026-20349)
Insufficient error checking in the Remote Access SSL VPN service lets an unauthenticated attacker reload the device with one crafted HTTP request, dropping the perimeter and the remote-access path at the same time. Affects ASA and FTD with SSL VPN, IKEv2 remote-access VPN with client services, or ZTNA enabled. Cisco PSIRT confirmed active exploitation in August; on CISA KEV with an August 14 deadline. No workaround. Cisco Security Advisory
VMware vCenter Syslog directory traversal, CVSS 9.8 (CVE-2026-59310)
Path traversal in the vCenter Syslog server reaching arbitrary code execution from network access. Patched July 29 in VMSA-2026-0006 (9.1.0.0300, 9.0.2.0100, 8.0 U3k), with no workaround. Exploitation started within five days: incident-response research published August 10 counts 361 victim IPs across 47 countries, led by Germany, the US, Turkey, Iran and France, with a malicious cron job installing reverse_ssh for persistence.
Quirso threat research
Microsoft SharePoint JWT authentication bypass, CVSS 9.1 (CVE-2026-55040)
Four chained weaknesses in the JWT validation pipeline let an unauthenticated attacker forge a token and impersonate any site user or administrator, and chain to a separate RCE for full unauthenticated code execution. Affects Subscription Edition, Server 2019 and Enterprise Server 2016; patched in July. Exploitation was reported on August 13, one day after the public PoC. Rapid7
Progress Kemp LoadMaster command injection, CVSS 9.6 (CVE-2026-8037)
Unsanitized API input handled by escape_quotes() gives an unauthenticated attacker arbitrary OS commands on an edge-deployed load balancer. Added to KEV on August 7 after 792 reported exploit attempts, with a three-day BOD 26-04 deadline of August 10. Fixed releases shipped in June: GA 7.2.63.2 and LTSF 7.2.54.18.
CISA
Windows AFD.sys use-after-free, exploited as a zero-day, CVSS 7.0 (CVE-2026-68820)
Two code paths race on socket state without synchronization, yielding a kernel read/write primitive and SYSTEM. The only exploited flaw in Microsoft's August release. Check Point attributes it to Lazarus Group's Operation Dream Job against defense and aerospace firms in France, Germany, Brazil and India, deploying the FudModule v3.1 rootkit; a rootkit artifact is timestamped July 7, about five weeks before the August 11 patch. Check Point Research
N-able N-central authentication bypass (CVE-2026-18577)
Second hotfix in two weeks while attackers were still reaching and persisting in managed systems through the Take Control feature. Hotfix 1 is build 2026.3.1.7; Hotfix 2 shipped this week and N-able says it is not a duplicate, so install it even if Hotfix 1 was applied. Microsoft ties the new StormEncryptor ransomware from Storm-1175 to this flaw as the likely entry vector. Hunt for svchost.exe in user Documents folders and a Cloudflared service registration.
N-able
TrueConf Server pre-auth RCE, no CVE (KLCERT-26-057, KLCERT-26-058)
Two flaws reachable without authentication on port 4307/TCP, which the documentation says is open by default, chain to arbitrary code execution as NT AUTHORITY\SYSTEM. Head Mare planted a web shell at …\public\js\locale.php and swapped the TrueConf client installer for PhantomCore and PhantomGraph backdoors served to meeting participants. Affects 5.3.x–5.3.9, 5.4.x–5.4.9 and 5.5.x–5.5.5; patched June 18.
Kaspersky Securelist
Patched, No Known Exploitation
SAP Commerce Cloud Data Hub Adapter code injection, CVSS 10.0 (CVE-2026-58231)
Insufficient authorization checks and input validation, classed CWE-94, reached by abusing a default authentication client, giving unauthenticated arbitrary code execution. Affects COM_CLOUD 2211 and 2211-JDK21. SAP Note 3771065, August patch day. SAP Security Notes
Adobe ColdFusion OS command injection, CVSS 10.0 (CVE-2026-48362)
Unauthenticated OS command injection with no user interaction, in ColdFusion 2025.0.11 and earlier and 2023.0.22 and earlier; fixed in 2025.0.12 and 2023.0.23. Bulletin APSB26-90 is Priority 1 and also closes CVE-2026-48273 (9.9, eval injection) and CVE-2026-71384 (9.6, incorrect authorization). Campaign Classic took two more CVSS 10.0 authorization flaws the same day, CVE-2026-71398 and CVE-2026-27302. SecurityWeek
Zoom annotation zero-click RCE, CVSS 8.3 / 6.5 / 8.3 (CVE-2026-53413, CVE-2026-53414, CVE-2026-53415)
CAnnoFormatBlock::Deserialize trusts network-supplied 32-bit character counts against fixed 128-byte buffers, so any meeting participant can execute code on another participant's machine with no click, no download and no prompt, in either direction between presenter and viewer. Fixed in Zoom Workplace 7.1.5 and 7.0.6, Workplace VDI client 7.0.11 and 6.6.16, Zoom Rooms 7.1.0 and Meeting SDK 7.1.0. Bulletins ZSB-26015 through ZSB-26017.
Zoom
Patch Bypassed
Microsoft Defender RoguePlanet, patch bypassed, CVSS 7.8 High (CVE-2026-50656)
Improper link resolution before file access (CWE-59) reaching SYSTEM, fixed in the Malware Protection Engine at build 1.1.26060.3008 on July 8. The ShieldBreak PoC published August 12 bypasses that fix, claiming 100% success against Windows 11 25H2 and Windows Server 2025 and noting Windows 10 is vulnerable but unsupported by the PoC. Treat the entry as open, not closed. MSRC
No CVE Assigned
Connective eID drive-by RCE and PIN theft (Belgium)
The signing extension never verified request origin, so any site or invisible iframe could read connected eID and Maestro card data, recover the eID PIN from a token shipping both ciphertext and decryption key, and trigger RCE at user level through a GET_READERS call pointing at an attacker-supplied DLL path. Deployed to more than two million users, eight of Belgium's ten largest banks and 60-plus government agencies. Disclosed at DEF CON 34; Nitro completed remediation July 22, 146 days after report. No CVEs assigned.
Bay Area Labs
BdThemes WordPress supply chain via poisoned JSON
Attackers took the vendor's cloud storage credentials and poisoned the static JSON feed behind BdThemes' "Biggopti" promotional banner, exploiting an XSS in the response parser to create rogue administrator accounts and drop PHP web shells. No source file in the WordPress.org repository changed and no plugin update was required. Affects Element Pack, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste and Smart Admin Assistant; poisoned records date to March 1. Wordfence
Curated Reading List
Thought-Provoking
"Impossible to hide secret …": Uncovering Security and Privacy Issues in LLM-native IDEs (York University / University of Calgary, ASE 2026) Why it's worth your time. 1.1 million Reddit posts filtered to 446 threads and 6,280 comments, coded into a 32-issue taxonomy, finding that most LLM-IDE security problems trace to system-level design choices rather than the model. Evidence for arguing about agent defaults in your own developers' words.
Blue Report 2026 (Picus Labs) Why it's worth your time. 338 million attack simulations in live production environments: prevention recovered to 69%, only 37% of post-compromise actions were blocked, quiet discovery and collection was stopped about one time in ten, and fewer than one in seven simulated attacks produced a meaningful alert.
The Patch Gap: Why Defenders Need to Think in Chains, Not Checklists (Dark Reading) Why it's worth your time. Models attack paths as a graph and uses minimum vertex cut to find the smallest set of fixes that disconnects the most paths to critical assets, with a worked example where a medium-severity credential exposure outranks a critical RCE on an isolated server.
Current Events
Updated GPG key for signing Firefox and Thunderbird releases (Mozilla Security Blog) Why it's worth your time. Mozilla's own account of revoking a release-signing subkey after an unencrypted copy landed in a private repo whose readers were all already authorized, with per-distribution import steps that show what the incident actually cost downstream packagers.
2,500+ Companies and 434,000 CI/CD Pipelines Exposed in the Largest AI Supply Chain Breach of 2026 (CloudSEK)
Why it's worth your time. Traces a leaked automation token through Trivy into LiteLLM's unpinned build and onto PyPI. The mechanism is the lesson: a malicious .pth file runs at interpreter start, so --ignore-scripts does nothing and installation alone was enough inside a 40-minute window.
OpenAI pledges to add Astra security as Anthropic loosens Fable's leash (The Register) Why it's worth your time. Two frontier labs moved opposite directions in one week, one adding isolated environments and universal risky-action monitoring for a model too capable at cyber, the other relaxing refusal behavior on its flagship. Context for any internal policy on agent autonomy.
