Breaking: Metabase CVSS 10.0 Zero-Day Under Active Exploit — 12 August 2026

Metabase CVSS 10.0 Zero-Day Under Active Exploitation

A maximum-severity SQL injection vulnerability in Metabase is being exploited in the wild. CVE-2026-72898 carries a CVSS score of 10.0, the highest possible rating. The flaw exists in the unauthenticated password reset endpoint (`POST /api/session/reset_password`), where undeclared request fields reach the application database query as structured input rather than validated identifiers. An attacker who can reach the endpoint gains full SQL injection into the Metabase application database with no credentials and no user interaction. From there, they can seize administrator access, reconfigure the instance, extract stored credentials for every connected database, and exfiltrate whatever data those connections can reach.

Metabase confirmed active exploitation on August 11. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog the same day with a three-day federal remediation deadline of August 14. The affected versions start at 1.58. Self-hosted instances exposed to the internet are at acute risk. Cloud-hosted Metabase instances are not affected.

Windows AFD.sys Zero-Day Exploited by Nation-State Actors

Microsoft's August 2026 Patch Tuesday patches 421 CVEs, but the one that matters most is already under attack. CVE-2026-68820 is a use-after-free in `afd.sys`, the kernel-mode Ancillary Function Driver for WinSock. A locally authenticated attacker can trigger a race condition to gain SYSTEM privileges with no user interaction required. Microsoft confirms active exploitation in the wild. Check Point Research attributes the discovery to their team, and Tenable's Satnam Narang notes that three previous afd.sys zero-days have been exploited by nation-state actors since 2022, including CVE-2024-38193, which was linked to North Korea's Lazarus group. CISA has given federal agencies until August 25 to patch.

The Patch Tuesday release also includes CVE-2026-62832, a publicly disclosed Windows User Profile Service privilege escalation bug that Microsoft rates as likely to be exploited, and a SharePoint RCE chain (CVE-2026-55040, CVSS 9.1) that was discovered using an AI vulnerability research agent.

Cisco ASA/FTD Firewall DoS Under Active Exploitation

CISA added CVE-2026-20349 to the KEV catalog on August 11 with a three-day deadline. The vulnerability allows an unauthenticated remote attacker to trigger an unexpected device reload on Cisco Secure Firewall ASA and FTD platforms, causing a denial of service condition. For organisations running these firewalls at the network edge, a reboot under load is not just an availability problem. It is a visibility and enforcement gap during the reload window. The three-day CISA deadline (August 14) signals confirmed exploitation.

So What / Action

Three infrastructure-layer vulnerabilities with confirmed exploitation landed on CISA's KEV catalog in the same 24-hour window, two of them carrying three-day remediation deadlines. If you run Metabase, patch to the fixed version immediately. If it cannot be patched today, restrict access to the password reset endpoint or take the instance offline. Audit Metabase query logs for signs of SQL injection attempts against `/api/session/reset_password`. For Windows, the afd.sys patch is not optional. Prioritise it for domain controllers, privileged workstations, and any system where an adversary already has a foothold. For Cisco ASA and FTD, check whether your firewalls have restarted unexpectedly in the past week, then apply the patch before Thursday's deadline.