3 New KEV Flaws: Metabase CVE-2026-72898 Tops CISA

On August 11, 2026, CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog, and the most urgent of them is a CVSS 10 SQL injection in Metabase that gives an unauthenticated attacker administrator access through the /reset_password endpoint. If your cloud estate runs a self-hosted Metabase instance that has not been updated to a fixed release, treat this as an emergency patch, not a routine monthly item. The other two entries, a Cisco firewall inspection flaw and a Windows kernel driver use-after-free, round out a catalog update aimed at edge infrastructure and endpoints.

Three flaws enter the KEV

The August 11 catalog update lists CVE-2026-20349 (Cisco Secure Firewall ASA and FTD heap inspection), CVE-2026-68820 (Windows Ancillary Function Driver for WinSock use-after-free) and CVE-2026-72898 (Metabase SQL injection), all added on the basis of evidence of active exploitation. Placement in the Known Exploited Vulnerabilities catalog is not a severity prediction; it is CISA confirming that attackers are already using these bugs in the wild. Under Binding Operational Directive 26-04, federal agencies must prioritize KEV entries on exposed assets that grant total control after exploitation, and CISA encourages every organization to apply the same risk-based logic.

How the Metabase attack works

The Metabase record is blunt about impact: a remote, unauthenticated attacker can inject arbitrary SQL through the /reset_password database endpoint and gain administrator access to the connected instance. No credentials, no user interaction, and no privileges are required. The endpoint sits in the authentication path itself, which is exactly where perimeter controls are weakest, because it must stay reachable for legitimate password recovery flows.

The scoring reflects that reachability. The flaw carries a CVSS 3.1 score of 10.0 and a CVSS 4.0 score of 10.0, the maximum on both scales, with a scope change that signals impact beyond the vulnerable component. In practice the blast radius is twofold: the attacker controls Metabase as an admin, and because Metabase holds credentials for the databases it queries, a successful injection often becomes a pivot into the analytics warehouse, the data lake, or whatever secret store the instance uses.

For defenders, the detection question matters as much as the patch. Legitimate /reset_password traffic is low-volume and patterned; sudden bursts of POSTs to that path from unfamiliar ASNs, or SQL syntax appearing in parameters where an email address belongs, are high-signal indicators worth wiring into your WAF rules and network sensor baselines before the patch window closes.

Affected versions and fixes

Every recent release line is affected. Per the CISA-published CVE record, the vulnerable ranges start at 58.0, 59.0, 60.0, 61.0, 62.0 and 63.0 respectively, and each branch has a fixed build: x.58.24, x.59.21, x.60.17, x.61.11, x.62.9 and x.63.5. That means the practical triage is simple: enumerate every Metabase deployment in the inventory, read its version, and compare it against the fixed matrix below.

• Branch 58: fixed in 58.24
• Branch 59: fixed in 59.21
• Branch 60: fixed in 60.17
• Branch 61: fixed in 61.11
• Branch 62: fixed in 62.9
• Branch 63: fixed in 63.5

Any version below the fixed build on its branch is exposed, and because exploitation is confirmed, patching alone is not the end of the workflow. Assume compromise assessment: review authentication logs for anomalous admin sessions, rotate the database credentials the instance stored, and check whether new users, questions or alerts were created in the window before the update landed.

Patch order for cloud teams

Prioritize by exposure and blast radius rather than by publication date. An ordered runbook keeps three parallel updates from becoming three improvised scrambles.

1. Enumerate Metabase instances first. Query your CMDB, container registries and load balancer rules for anything answering on Metabase ports; analytics tooling is frequently deployed outside normal change control.
2. Patch internet-facing Metabase to a fixed build, then rotate its stored database credentials and invalidate active sessions.
3. Update Cisco ASA and FTD images on perimeter pairs, following the maintenance-window discipline you already use for edge devices.
4. Deploy the Windows AFD fix through your standard endpoint channel, pairing it with a check for suspicious local privilege escalation events.
5. Add KEV feeds to your vulnerability management loop so the next catalog update drives automatic prioritization instead of a manual read of security news.

Organizations running Metabase behind a VPN or an IP allowlist still need to patch: the flaw needs no authentication, so any path to the instance, including a compromised jump host or an SSRF pivot from another workload, is enough. Readers mapping where controls like these sit relative to identity, network and data layers can revisit our cloud security layers diagram, and teams that deferred the recent Joomla CVSS 10 remediation should treat that CMS flaw as part of the same backlog, since both hand over full control without credentials.

The common thread across this catalog update is unauthenticated, high-impact access at layers defenders often treat as trusted: the BI tool, the firewall, the endpoint driver. Risk-based patching keyed to the KEV list, backed by version inventory and post-patch compromise checks, converts that trust back into verification.

Sources

• CISA Alert: CISA Adds Three Known Exploited Vulnerabilities to Catalog (August 11, 2026)
• CVE Record CVE-2026-72898, Metabase SQL Injection (CISA CNA)