Security Check-in Quick Hits: Metabase Zero-day, N-central Rmm Breaches & Loadmaster Kev Escalation

Metabase Critical SQL Injection Zero-Day Actively Exploited for Data Theft

Metabase, the popular open-source business intelligence and data visualization platform, disclosed a maximum-severity (CVSS 10.0) SQL injection flaw with no assigned CVE that was exploited in the wild as a zero-day. The bug allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, granting full administrator access. From there, attackers can alter configuration, steal stored database credentials, read any accessible data, and export it.

Metabase Cloud instances were already patched. Self-hosted users on affected versions (broadly 1.58+ through recent 1.63.x branches) must immediately apply the specific fixed releases (e.g., 1.58.24, 1.59.21, etc.). Temporary mitigation: block the /api/session/reset_password endpoint. Confirmed indicators include a 400 response on that POST followed by a successful GET to /api/user/current. Framework (the PC maker) confirmed customer data (names, emails, addresses, phones, login IPs) was accessed; payment data was not.

This is a textbook high-impact BI platform compromise: one unauthenticated path to the data warehouses many organizations treat as internal only. Patch now and audit sessions, API keys, admin accounts, and connected database credentials.

N-able N-central RMM Auth Bypass (CVE-2026-18577): Attackers Reach Managed Customer Systems; Hotfix 2 Issued

N-able confirmed ongoing exploitation of CVE-2026-18577 (an authentication bypass / incomplete fix for a prior flaw, CVSS ~8.2), which hands unauthenticated attackers full administrative access to N-central servers. The product is widely used by MSPs for remote monitoring and management, so compromise of the console can cascade to customer endpoints via features such as Take Control.

Exploitation was observed starting around July 31. Attackers leveraged the access to reach managed systems and establish persistence (including Cloudflare Tunnels). N-able released Hotfix 1 (2026.3.1.7), then quickly followed with mandatory Hotfix 2 (2026.3.1.10) after continued monitoring of evolving techniques. Hosted instances are handled by N-able; on-premises customers must apply Hotfix 2 even if they already installed the first. CISA previously added the issue to its KEV catalog with an aggressive three-day federal remediation window.

RMM platforms remain high-value targets precisely because they sit above the customer estate. Treat any unpatched or internet-exposed N-central instance as potentially compromised: rotate credentials, review accounts/permissions, enforce MFA, and hunt for the shared IoCs (remote tools, tunnels, anomalous accounts).

Progress Kemp LoadMaster Command Injection (CVE-2026-8037) Lands in CISA KEV After Hundreds of Exploit Attempts

CISA added the critical Progress Kemp LoadMaster OS command injection vulnerability (CVE-2026-8037, CVSS 9.6) to its Known Exploited Vulnerabilities catalog on August 7–8 after reports of active exploitation attempts (hundreds observed). The flaw allows an unauthenticated attacker to execute arbitrary commands on the appliance by abusing unsanitized input in multiple API command endpoints.

Affected versions include LoadMaster GA 7.2.63.1 and earlier plus LTSF 7.2.54.17 and earlier. Patches have been available since early June (GA 7.2.63.2 / LTSF 7.2.54.18). The addition triggers CISA’s accelerated remediation timelines under current Binding Operational Directives. Edge load balancers with the management/API interface exposed remain attractive targets for initial access into enterprise networks.

If you run LoadMaster, confirm the API surface is not reachable from untrusted networks and move to the fixed builds immediately. This is a classic “patch exists but exploitation continues until the long tail is cleaned up” story.

These three issues—unauthenticated BI platform takeover, RMM console-to-customer pivots, and edge load-balancer RCE—illustrate the continuing pressure on internet-facing or management-plane software. Prioritize inventory of Metabase, N-central, and LoadMaster instances, apply the latest fixes, and hunt for the published indicators.