Cloud roundup: Metabase CVSS 10 SQLi confirmed exploited

Another security-heavy day: the Metabase bug I flagged Monday as a zero-day with no CVE now has one and is confirmed under active exploitation, Cisco’s VPN appliances picked up an exploited DoS flaw, and Microsoft’s August Patch Tuesday landed with an already-exploited zero-day of its own.

Metabase’s CVSS 10 SQL injection now has a CVE and is in CISA KEV

CVE-2026-72898 is an unauthenticated SQL injection in Metabase’s password-reset endpoint (POST /api/session/reset_password) that lets an attacker inject arbitrary SQL into the application database and walk away with admin access — no auth, no user interaction required, CVSS 10.0 (Bishop Fox). CISA added it to the Known Exploited Vulnerabilities catalog on August 11 (CISA). It affects a wide version range — 0.58 through 0.63.4 and the matching Enterprise 1.x builds — so if you’re running self-hosted Metabase anywhere, including a “just for internal dashboards” instance, patch it now and don’t wait for the next maintenance window. Admin takeover on a BI tool usually means access to every data source it’s connected to, which for most of us is production databases and warehouses.

Cisco ASA and FTD hit with an actively exploited VPN DoS flaw

CVE-2026-20349 (CVSS 8.6) is a heap inspection bug in Cisco Secure Firewall ASA and FTD’s Remote Access SSL VPN service — a crafted, unauthenticated HTTP request can crash the device and force a reload (The Hacker News). Cisco confirmed active exploitation and CISA added it to KEV in the same August 11 batch as the Metabase bug, with a federal remediation deadline of August 14. If you’ve got ASA/FTD devices with SSL VPN listeners facing the internet, this is a “patch this week” item — a device that keeps rebooting under attacker control is its own kind of outage, on top of whatever else the attacker is probing for while it’s down.

Microsoft’s August Patch Tuesday: ~400 fixes, one already exploited

Microsoft’s August Patch Tuesday shipped fixes for roughly 400 vulnerabilities including three zero-days, and confirmed one — CVE-2026-68820, a use-after-free elevation-of-privilege bug in the Windows Ancillary Function Driver for WinSock — is already being exploited in the wild (BleepingComputer). AFD.sys bugs are a recurring privilege-escalation path once an attacker has any foothold, so this is the one to prioritize on your Windows fleet — EC2 Windows instances, jump boxes, and anything else running Windows — even though the initial-access vector is elsewhere.

Also worth a look

Amazon Connect added a performance dashboard for Cases, giving managers case-volume, resolution-trend, and SLA-attainment views without building custom reporting on top of the Cases API — a small but welcome addition if you’re running support workflows through Connect.

Bottom line

Two unauthenticated, actively-exploited bugs landed in KEV on the same day — Metabase SQLi and the Cisco ASA/FTD DoS — so triage internet-facing instances of either today. The Windows AFD zero-day is a “patch it in the normal cycle, but don’t push the normal cycle out” item.