Saturday, August 8, 2026
Daily digest
Heavy vulnerability day: a maximum-severity Metabase zero-day, continued N-able N-central exploitation, and a new CISA KEV entry for Kemp LoadMaster all landed within hours of each other — prioritize patching triage today.
Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
Metabase disclosed a maximum-severity (CVSS 10.0) flaw, without an assigned CVE, that lets an unauthenticated attacker inject arbitrary SQL into the application database and gain admin access. The bug has been actively exploited in the wild, with confirmed breaches at Framework and Tally reported by BleepingComputer.
Why it matters: If Metabase is used anywhere in the environment for BI/reporting on CUI-adjacent data, treat this as an emergency patch — unauthenticated DB access is a direct NIST 800-171 data exposure risk.
N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist
N-able released a second round of hotfixes for its N-central RMM platform after confirming attackers exploiting a recently disclosed flaw reached customer-managed systems and established persistence. The company says this is a new, expanded protection effort, not a duplicate of its earlier fix.
Why it matters: RMM compromise is a direct path to downstream customer networks; if N-central touches any managed endpoints in scope, apply the hotfix immediately and audit for unauthorized persistence.
Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts
CISA added a critical Progress Kemp LoadMaster command injection flaw (CVE-2026-8037, CVSS 9.6) to its Known Exploited Vulnerabilities catalog following active exploitation attempts. The vulnerability allows arbitrary command execution.
Why it matters: KEV listings carry federal remediation deadlines under BOD 22-01; if LoadMaster is deployed for load balancing anywhere in the CMMC boundary, it must be patched or removed from network exposure per required timelines.
18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers
A use-after-free bug in Linux's SCTP networking code, present since 2008, can be exploited for local privilege escalation to root and container escape. Tencent researchers demonstrated escaping a container to compromise the host. Fixed kernels (7.1.6, 6.18.42, 6.12.101, 6.6.148) shipped August 3.
Why it matters: Any Linux VMs or container workloads on Nutanix AHV with SCTP enabled should be patched to the fixed kernel versions — this is a full host-compromise path from a single compromised container.
Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access
Entra ID researcher Dirk-jan Mollema demonstrated that malware running in a signed-in Windows session can silently use the victim's Windows Hello for Business key to authenticate to Microsoft Entra ID, register an attacker-controlled device, and obtain a Primary Refresh Token for persistent cloud access.
Why it matters: On an Intune-managed Windows 11 fleet using WHfB for passwordless auth, endpoint compromise can now translate directly into durable Entra ID/GCC High tenant access — review conditional access and device compliance policies to limit PRT abuse.
Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails
An active adversary-in-the-middle phishing campaign is hijacking Microsoft 365 accounts to identify financial workflow personnel and harvest payroll and finance-related email. The campaign uses residential proxies to disguise malicious sign-ins as normal consumer traffic.
Why it matters: AitM bypasses standard MFA; verify conditional access policies enforce phishing-resistant authentication (FIDO2/certificate-based) for finance and HR roles in the M365 GCC High tenant.
Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
Researchers identified nearly 800 malicious npm packages using AI-generated typosquatted names that deliver a cross-platform RAT and infostealer targeting Windows, Mac, and Linux systems. The campaign appears to use randomly generated package names to evade detection.
Why it matters: Any Ansible tooling or development pipelines pulling npm dependencies should have dependency scanning and allowlisting in place — this scale of typosquatting campaign increases the odds of accidental inclusion in CI/CD.
Some Contractors Got CMMC Certified Early — Now Implementation Is on Hold
Contractors who completed CMMC certification ahead of the formal rollout schedule now face uncertainty as broader program implementation has stalled. Industry voices note the phased rollout was designed to sequence certifications, and early movers are left without the intended process behind them.
Why it matters: If certification timing or renewal planning is on the roadmap, this signals continued schedule uncertainty — hold off on assuming a fixed enforcement date and keep NIST 800-171 controls audit-ready regardless.
New 'Water Watch Center' Launched to Help Small Utilities Stop Cyberattacks
The National Rural Water Association partnered with a DEF CON-affiliated group to launch the Water Watch Center, a program to help under-resourced water utilities defend against rising cyber threats. The initiative comes amid multiple state-level water system intrusions suspected to be linked to Iran.
Why it matters: Reflects continued nation-state targeting of OT/ICS infrastructure with weak remote access controls — a relevant reminder to review remote monitoring and VPN exposure on any facilities/OT systems in scope.
Attacker Phished Way Into US Defense Supplier's Microsoft 365 Account
Defense supplier IEH Corporation disclosed to the SEC that an attacker used social engineering to compromise a Microsoft 365 account, gaining access to engineering files and potentially export-controlled technical data. The company said it detected and moved to contain the intrusion after discovering it Tuesday.
Why it matters: A defense supplier M365 phishing compromise leading to export-controlled data exposure is exactly the CUI-handling scenario CMMC L2 controls target — a useful case for reinforcing phishing-resistant MFA and CUI labeling/DLP in GCC High.
Securing Amazon S3 Buckets: Identifying and Remediating Over-Permissioned Access
AWS published guidance on identifying and fixing over-permissioned S3 bucket policies and ACLs, covering tools and methods to detect broad access configurations that can go unnoticed and expose data.
Why it matters: Directly applicable to AWS GovCloud S3 usage — a good prompt to audit bucket policies and ACLs against NIST 800-171 access control requirements as part of routine CMMC hygiene.
MIT Researchers' TONTOU Attack Slips Through Spectre Defenses on Intel and AMD CPUs
MIT researchers disclosed TONTOU, a new speculative execution attack that reopens the branch predictor poisoning window by exploiting timer interrupts, bypassing existing Spectre mitigations on Intel and AMD CPUs. A working exploit was demonstrated against AMD Zen 2 processors, presented at Black Hat USA 2026.
Why it matters: A new speculative-execution bypass affecting Intel and AMD CPUs is relevant to Nutanix AHV hosts running multi-tenant VMs — watch for hypervisor and microcode patches and reassess side-channel isolation for any co-located sensitive workloads.