Five Vulnerabilities That Shaped This Week in Security

This week was unusually dense. August Patch Tuesday brought over 400 fixed vulnerabilities, CISA added four entries to its actively exploited catalog across two weeks, and one researcher published a working Defender exploit for which no patch exists.

We picked the five items with the greatest practical impact. For each: what it affects, whether it is actively exploited, and what to do about it.

1. Metabase — a 10.0 severity flaw with confirmed victims

CVE-2026-72898 · CVSS 10.0 · actively exploited · patch available

Metabase is a widely used open-source business intelligence and reporting platform. The flaw lets an unauthenticated attacker inject arbitrary SQL through the password reset endpoint (/reset_password) and obtain administrator access to the entire instance.

No credentials, no user interaction, remote attack with low complexity. From there it is one step to the data, because Metabase stores connection credentials for every database it is wired into. The attacker gains not just Metabase, but everything behind it.

This is not theoretical. The n8n platform disclosed on 8 August that an attacker used this vulnerability to obtain 136 customer records containing names and email addresses. CISA added the flaw to its actively exploited catalog on 11 August.

What to do: Affected versions span the 0.58/1.58 through 0.63.4 branches. Metabase has released patches across all affected branches. Update immediately. If the instance was internet-facing, assume compromise: rotate credentials for every connected database and review administrator accounts and data exports.

2. N-able N-central — an attack on the tool service providers manage with

CVE-2026-18577 · actively exploited since 1 August · patch available (second release)

N-able N-central is a remote monitoring and management platform used by managed service providers and internal IT teams to administer endpoints, servers, and network devices. The flaw lets an unauthenticated attacker bypass login and gain administrative control of the N-central server.

What follows is the dangerous part. Attackers use the built-in Take Control remote access feature to reach customers' managed endpoints, and deploy Cloudflare Tunnel for persistent access. One compromised N-central server means a potential breach into every client that provider manages.

A particularly awkward detail: this is not a new vulnerability but a new method of exploiting a previously patched flaw (CVE-2026-18556). The first fix was incomplete, and N-able had to ship a second hotfix on 6 August because attacks continued.

What to do: Update to version 2026.3.1.10, the second hotfix. The first fix (2026.3.1.7) did not resolve the issue, so verify you actually have the newer one. Both on-premises and cloud deployments are affected. Review administrator accounts, Take Control usage logs, and check for a cloudflared process on managed endpoints.

If an external provider runs your IT, this is a legitimate reason to ask whether they operate N-central and whether it is patched.

3. Cisco ASA and Firepower — one request takes the firewall down

CVE-2026-20349 · CVSS 8.6 · actively exploited · patch available

A flaw in Cisco Secure Firewall ASA and Threat Defense software lets an unauthenticated attacker remotely reload the firewall with a specially crafted HTTP request to the Remote Access SSL VPN service. The cause is insufficient error checking during request processing.

Nothing needs to be known or bypassed: no credentials, no interaction from an administrator or VPN user. Repeated requests can hold the device in a reboot loop, which means loss of remote access and, in many topologies, loss of connectivity for an entire site.

CISA ordered US federal agencies to remediate by 14 August — an unusually short deadline for this class of vulnerability and a good indicator of how seriously it is being taken.

What to do: Affected devices are those with remote access services enabled: SSL VPN, IKEv2 remote access with client services, and Zero Trust Network Access on FTD. Apply Cisco's fix. If that is not immediately possible, consider temporarily restricting VPN interface reachability to known address ranges.

4. Windows afd.sys — privilege escalation to SYSTEM, exploited in the wild

CVE-2026-68820 · actively exploited · patched in August Patch Tuesday

August Patch Tuesday (11 August) fixed over 400 vulnerabilities. Three were zero-days, and one of those was demonstrably being exploited by attackers in production environments.

It is a use-after-free flaw in the Ancillary Function Driver for WinSock (afd.sys), the kernel-mode driver behind the Windows Sockets API. An attacker who already has ordinary user access on a machine can use it to escalate privileges to SYSTEM.

On its own it does not enable external compromise. In an attack chain it is decisive: the attacker gets in through phishing or a vulnerable application, then uses this flaw to take full control of the machine. CISA added it to the actively exploited catalog on 11 August.

What to do: Deploy the August Windows updates, prioritising user workstations, since that is where most attacks begin. Review logs for unusual process execution and changes to privileged accounts.

5. ShieldBreak — a Defender zero-day with no patch

Bypasses CVE-2026-50656 (RoguePlanet) · public exploit · no patch

This is a continuation of a story we covered in our June vulnerability roundup.

In June, a vulnerability called RoguePlanet, tracked as CVE-2026-50656, was disclosed in the Microsoft Defender engine, allowing a local user to obtain SYSTEM privileges. Microsoft fixed it on 9 July with an engine update to version 1.1.26060.3008.

Shortly after August Patch Tuesday, the same researcher (using the handle Nightmare Eclipse) published an exploit called ShieldBreak that bypasses this fix. Where RoguePlanet abused a file-handling race condition using virtual disks, ShieldBreak uses a user-mode callback to swap file contents during a Defender cloud-hydration scan.

The result is the same: a SYSTEM shell on fully patched Windows 11 25H2 and Windows Server 2025, with a reported 100% success rate. Windows 10 and its server editions are vulnerable too — the published exploit simply does not support them yet. Independent researcher Will Dormann verified it works.

The paradox: the exploit only works when Defender is enabled. The security tool becomes the entry point.

Microsoft is investigating; no fix yet. The disclosure also followed Microsoft weighing legal action against the researcher.

What to do: Until a patch exists, reduce the attack surface. The attacker first needs ordinary access to the machine, so that is where to focus:

• Restrict local administrator rights to the necessary minimum

• Deploy application allowlisting so unknown binaries cannot run

• Enable Tamper Protection for Defender

• Deploy Attack Surface Reduction rules, first in audit mode, then blocking

• Verify the Defender engine is at least version 1.1.26060.3008 (older versions remain vulnerable to the original RoguePlanet)

Priority summary

What to take away from this week

Two of the five vulnerabilities share a common thread: they were flaws in tools meant to provide security. A Cisco firewall and the Defender antivirus engine. A security layer is not automatically trustworthy simply because it is a security layer.

The second lesson concerns incomplete fixes. N-able had to patch a patch, and Microsoft's July fix was bypassed. Deploying an update is not the end of the process. Verify that the fixed version genuinely resolves the issue, and watch for follow-up hotfixes.

Third: compromising a remote management tool is one of the most effective ways to reach dozens of companies at once. If an external provider runs your IT, their security is part of your risk profile.

Struggling to keep up?

We publish this roundup weekly. Reading it is only the first step, though. The harder part is knowing which vulnerabilities actually affect you, in what order to address them, and who in the organisation owns that.

That is where we help: security assessment and vulnerability management · external security manager · technology selection and deployment

Book a free consultation → · Dealing with an incident right now? →

We will tell you plainly what is worth addressing first. Free, answer within 24 hours.