SQL Injection in Metabase Grants Full Administrator Access as CISA Updates KEV Catalog

Summary

CISA has updated its Known Exploited Vulnerabilities (KEV) catalog to include three new entries: a critical SQL injection vulnerability in Metabase, a denial of service flaw in Cisco Secure Firewall software, and a local privilege escalation bug in Microsoft Windows. The inclusion of these vulnerabilities follows evidence of active exploitation in the wild.

The most severe threat involves Metabase, where an unauthenticated remote attacker can inject arbitrary SQL via a specific endpoint to gain full control over the application instance. Simultaneously, Cisco's Remote Access SSL VPN service is susceptible to unexpected reloads that disrupt network availability.

Technical Details: Metabase SQL Injection

The Metabase vulnerability (CVE-2026-72898) allows an unauthenticated remote attacker to inject arbitrary SQL through the /reset_password database endpoint. This flaw can lead to total takeover of the connected Metabase instance.

Once an attacker gains administrator access, they can modify application configurations, steal credentials for all connected databases, read any accessible data, and export sensitive information. Metabase has confirmed that this vulnerability was used in a zero-day attack against Metabase Cloud.

Technical Details: Cisco DoS

A flaw in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software allows an unauthenticated, remote attacker to trigger unexpected device reloads.

The issue stems from insufficient error checking when processing HTTP requests. By sending a crafted HTTP request to the affected service, an attacker can cause a denial of service (DoS) condition. This affects configurations where IKEv2 Remote Access VPN, SSL VPN, or Zero Trust Network Access features are enabled.

Detection Opportunities

Metabase users should monitor application and ingress logs for a specific two-step request pattern that indicates a potential compromise:

POST /api/session/reset_password HTTP/1.1
Status: 400 Bad Request

GET /api/user/current HTTP/1.1
Status: 200 OK

If this sequence appears in your logs, the instance has likely been compromised.

Defender Guidance

Metabase Remediation

Upgrade to a minimum safe release immediately based on your current version:

If an immediate upgrade is impossible, block the /api/session/reset_password endpoint as a temporary workaround. After upgrading, you must perform these recovery steps:

• Delete all rows in the core_session table within the Metabase application database to revoke active sessions.
• Delete any unrecognized API keys.
• Review administrator accounts for unauthorized changes.
• Rotate credentials for all connected databases.

Cisco Remediation

Cisco has released software updates to address the DoS vulnerability. There are no available workarounds for this issue; upgrading to a fixed release is the only solution.

Affected ASA versions include hot fixes for:

• 9.16, 9.18, 9.20, 9.22, 9.23, and 9.24

Affected FTD versions include hot fixes for:

• 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0

Microsoft Windows

For the Windows Ancillary Function Driver for WinSock vulnerability (CVE-2026-68820), authorized attackers can elevate privileges locally via a use-after-free flaw. Apply relevant Microsoft security updates to mitigate this risk.