Cyber Threat Brief — August 9 2026
⚠️ This report is AI-generated. Always validate findings.
1. Metabase SQLi Zero-Day — Pre-Auth Admin Takeover
TL;DR: Unauthenticated SQLi in Metabase’s password-reset endpoint (CVSS 10.0, no CVE assigned) gives full admin access and database credential theft. Exploited since August 3; Framework and Tally confirmed as victims with customer data exfiltrated.
What’s New:
- Metabase disclosed August 7 that cloud instances were compromised via the
/api/session/reset_passwordendpoint starting ~August 3 - Unauthenticated attacker injects SQL into the application database, escalates to admin, steals connected database credentials, and exports data
- Confirmed victims: Framework (laptop maker) and Tally — customer PII (names, emails, addresses, phone numbers) accessed
- Affects versions 0.58+ / 1.58+; patched in 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5
- No CVE assigned yet; not on CISA KEV yet
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
POST /api/session/reset_password → HTTP 400, then GET /api/user/current → 200 | Exploitation signature | T1190 | Reverse proxy / WAF logs | Hunt — two-step log pattern is primary IOC |
/api/session/reset_password endpoint | Attack surface | T1190 | Application config | Block — WAF rule or upstream deny until patched |
| New admin accounts, modified API keys | Persistence indicator | T1136.001 | Metabase audit log, metabase_audit.v_audit_log | Hunt — review admin account creation since Aug 1 |
| Connected database credentials (stored in Metabase app DB) | Credential theft | T1555 | Database audit logs | Rotate — all credentials for databases connected to Metabase |
| Metabase versions 0.58.0–0.63.4 / 1.58.0–1.63.4 | Vulnerable asset | T1190 | Asset inventory | Patch — upgrade to fixed versions immediately |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No Metabase-specific detection — need web access log rule for POST /api/session/reset_password + subsequent admin API calls |
| Elastic | None | No Metabase-specific detection — custom rule on HTTP 400→200 pattern at reset endpoint |
| Sigma | None | No Metabase-specific detection — write web proxy rule for reset_password endpoint abuse |
Sources: The Hacker News · BleepingComputer · SQ Magazine
2. Progress Kemp LoadMaster CISA KEV — CVE-2026-8037
TL;DR: CISA added the CVSS 9.6 pre-auth RCE in Progress Kemp LoadMaster to KEV on August 8. Federal deadline is TOMORROW August 10. 792 exploitation attempts logged from 65 IPs across 18 countries.
What’s New:
- CISA KEV addition August 8 — confirms active exploitation in the wild
- 792 exploitation attempts over 41 days from 65 unique IPs in 18 countries per KEVIntel telemetry
- Federal remediation deadline: August 10, 2026 (tomorrow, Sunday)
- Pre-auth root RCE via uninitialized heap in
escape_quotes()+ command injection at/accessv2endpoint — single HTTP request to root - watchTowr full exploit chain public since June 29
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
POST /accessv2 with shell metacharacters | Exploitation signature | T1190 | WAF / reverse proxy logs | Block — WAF rule on /accessv2 endpoint with command injection patterns |
| LoadMaster GA ≤ v7.2.63.1, LTSF ≤ v7.2.54.17 (API enabled) | Vulnerable asset | T1190 | Asset inventory | Patch — GA v7.2.63.2 / LTSF v7.2.54.18 |
| 65 attacker IPs (18 countries) per KEVIntel | Attacker infrastructure | T1190 | Firewall / IDS logs | Hunt — correlate against LoadMaster access logs |
| LoadMaster sits on network edge, terminates TLS | Impact amplifier | T1557 | Network architecture | Assess — compromised appliance = compromised transit traffic |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No LoadMaster-specific detection — need WAF/proxy rule for /accessv2 command injection |
| Elastic | None | No LoadMaster-specific detection |
| Sigma | None | No LoadMaster-specific detection — write web proxy rule for /accessv2 POST with shell metacharacters |
Sources: The Hacker News · eSentire Advisory · watchTowr Labs
Status Updates
- CVE-2025-68686 (FortiOS symlink persistence bypass): Federal CISA KEV deadline TOMORROW August 10. No new artifacts. Original brief.
- CVE-2026-8037 (Progress Kemp LoadMaster): See Section 2 above — upgraded from status update to full coverage due to KEV addition and confirmed mass exploitation.
- CVE-2026-18577 / CVE-2026-18556 (N-able N-central): Federal deadlines passed August 6-7. Hotfix 2 released August 6. Exploitation ongoing — attackers evolving techniques against initial fix. Original brief.
- CVE-2026-6875: Active exploitation entering sixth week. Two sandbox-escape gadget chains confirmed. Fortune 500 victims. Still not on CISA KEV. Original brief.
- CVE-2026-20316 (Cisco FMC static credential): Federal CISA KEV deadline passed August 1. Zero-day exploitation via hardcoded credential ongoing. Original brief.
- CVE-2026-15409 / CVE-2026-15410: INC ransomware exploitation continues. 885+ victims per Resecurity. No new artifacts.