Breaking: Metabase 10.0 Zero-Day, CISA Emergency Directive for Windows AFD, VMware vCenter Exploited Across 47 Countries — 14 Aug 2026

Metabase Zero-Day (CVSS 10.0) Actively Exploited — CISA KEV Deadline Today

A maximum-severity SQL injection vulnerability in Metabase is being exploited in the wild as a zero-day. CVE-2026-72898 carries a CVSS score of 10.0 and allows unauthenticated remote attackers to inject arbitrary SQL via the password-reset endpoint, granting administrator access to the Metabase instance. From there, attackers can steal stored database credentials, read connected data, modify application configuration, and export information. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 11, with a federal remediation deadline of August 14 — today.

Metabase Cloud was directly attacked. Framework, the laptop maker, confirmed customer names, login IPs, addresses, phone numbers, and emails were accessed. Workflow automation platform n8n disclosed that 136 customer records were compromised, including bcrypt-hashed passwords for five n8n Cloud accounts and a historical bug that stored passwords in plaintext for 25 users. Kilo Code confirmed its Slackbot integration was compromised. Wiz estimates approximately 2,500 self-hosted Metabase instances are internet-accessible, with around 25% of cloud environments running Metabase exposed.

Affected versions span x.58.0 through x.63.3. Patches are available: x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, and x.63.5. As a temporary workaround, block the `/api/session/reset_password` endpoint. After patching, revoke all active sessions, audit admin accounts and API keys, and rotate credentials for all connected databases. Look for the IoC pattern: a POST to `/api/session/reset_password` returning 400, followed by a GET to `/api/user/current` returning 200.

CISA Emergency Directive: Windows AFD Zero-Day Exploited by North Korean APT

CISA has issued an Emergency Directive requiring all federal civilian executive branch agencies to patch CVE-2026-68820 within 14 days. The vulnerability is a use-after-free race condition in the Windows Ancillary Function Driver for WinSock (afd.sys) that allows an attacker with a low-privileged foothold to escalate privileges to full SYSTEM control. Patched in Microsoft's August 2026 Patch Tuesday, the exploit requires a system reboot with no viable workaround.

The directive follows confirmed active exploitation by North Korean state-sponsored actors, attributed to ongoing Operation Dream Job campaigns. The attack chain uses social engineering lures on platforms like LinkedIn, targeting technical and engineering professionals in the defense, aerospace, drone, and robotics sectors across North America, Europe, and India. Victims are induced to download trojanized PDF viewers or malicious application archives via DLL sideloading, which then deploy persistent backdoors (ForestTiger, Troy) and trigger the AFD exploit for kernel-level privilege escalation.

VMware vCenter Exploited Across 47 Countries

A critical directory-traversal vulnerability in VMware vCenter is being actively exploited in the wild, with 361 unique victim IP addresses identified across 47 countries. CVE-2026-59310 (CVSS 9.8) resides in the vCenter Syslog server component, allowing unauthenticated remote code execution. Patches were released by Broadcom on July 29. QUIRSO, the German cybersecurity firm tracking the campaign, found that compromised systems began contacting attacker infrastructure on August 3, just five days after public disclosure.

The attack chain involves path traversal through the syslog service, followed by deployment of a malicious cron job to establish persistence using reverse_ssh, an open-source tool that creates outbound SSH tunnels to attacker-controlled infrastructure, bypassing inbound firewall rules. The activity strongly correlates with APT-level tradecraft, and Chinese threat actor UNC5174 has previously weaponised VMware vulnerabilities in espionage campaigns. Separately, Defused Cyber reports a spike in scanning targeting CVE-2026-59309 (CVSS 9.8), an authentication bypass in vmdir, suggesting broader exploitation efforts against VMware infrastructure are underway.

So what / Action: Three urgent items demand attention this week. Patch Metabase immediately if you run it, especially any internet-facing instances, and check for the reset_password IoC pattern. Deploy Microsoft's August Patch Tuesday updates across all Windows endpoints, prioritising systems used by staff in defence, aerospace, and high-tech sectors, and enforce reboots. If you operate VMware vCenter, apply Broadcom's VMSA-2026-0006 patches now, audit for reverse_ssh and unexpected cron jobs, and segment vCenter management interfaces from the internet. All three vulnerabilities share a common trait: the window between disclosure and exploitation has collapsed to days, not weeks.