Patch Tuesday August 2026: Metabase CVSS 10 SQLi, Cisco VPN crasher, and a Windows privesc, all exploited
Three bugs exploited in the wild top this month: unauthenticated SQL injection in Metabase's password reset endpoint (CVE-2026-72898, CVSS 10.0), a remote DoS crashing Cisco ASA/FTD SSL VPNs (CVE-2026-20349, CVSS 8.6), and a WinSock use-after-free escalating to SYSTEM (CVE-2026-68820, CVSS 7.0). SharePoint Server also gets an 8.8 RCE that any authenticated user can trigger.
Three bugs are already exploited in the wild this month, and one of them is a CVSS 10 SQLi in Metabase that needs zero credentials to pull off. Cisco ASA/FTD VPNs are getting knocked offline by crafted HTTP requests, and a Windows WinSock privilege escalation is giving attackers SYSTEM after initial access. Beyond those three, SonicWall GMS, SharePoint, and HPC Pack all have critical RCEs waiting in the wings. Here's what to patch and what to watch.
Today's CVEs
Sorted by urgencyCVE-2026-20349
NVDAn unauthenticated attacker can send a crafted HTTP request to your Cisco ASA or FTD SSL VPN and crash the device, forcing a reload. This is exploited in the wild right now. If your remote access VPN goes down, every remote worker loses connectivity until the box comes back up.
- Affected estate
- Anyone running Cisco ASA or FTD with Remote Access SSL VPN enabled
- How to check
- Run 'show running-config webvpn' on the ASA/FTD CLI. If you see the 'enable' directive under an interface, you're exposed.
- Included because
- unauthenticated; internet-facing; actively exploited; common VPN appliance
- Action
- Apply the fixed software version from the Cisco Security Advisory and verify VPN functionality post-upgrade.
- Why it matters
- Attackers are already crashing firewalls remotely, knocking out VPN access for your entire remote workforce.
- Source
- Cisco Security Advisory
Evidence trail
- NVD: View source
CVE-2026-68820
NVDA use-after-free bug in the Windows Ancillary Function Driver for WinSock lets a local attacker who already has a foothold escalate to SYSTEM. This is exploited in the wild. It requires local access, so it's typically a post-compromise privilege escalation step, but the active exploitation makes it urgent.
- Affected estate
- Windows sysadmins across all supported Windows client and server versions
- How to check
- Check the installed KB against the latest cumulative update listed in the Microsoft Security Update Guide. Run 'systeminfo' or query WSUS/SCCM for patch status.
- Included because
- local privilege escalation; exploited in the wild; affects all Windows versions; common post-compromise technique
- Action
- Deploy the current month's cumulative update via WSUS, SCCM, Intune, or Windows Update.
- Why it matters
- Attackers with any local foothold can escalate to SYSTEM, making this a key link in attack chains already seen in the wild.
- Source
- Microsoft Security Update Guide
Evidence trail
- NVD: View source
CVE-2026-72898
NVDAn unauthenticated attacker can hit the '/reset_password' endpoint in Metabase and inject arbitrary SQL to gain full admin access. CVSS 10.0, exploited in the wild. No credentials needed, no user interaction. If your Metabase instance is internet-facing, assume it's a target right now.
- Affected estate
- Anyone running a self-hosted Metabase instance, especially if it's exposed to the internet
- How to check
- Check your Metabase version at Settings > Admin > About Metabase, or run 'curl http://your-metabase/api/health' and compare the version against the vendor advisory.
- Included because
- unauthenticated; internet-facing; CVSS 10.0; exploited in the wild; SQL injection to admin
- Action
- Upgrade to the latest fixed Metabase release. Review database audit logs for unexpected password reset activity or new admin accounts.
- Why it matters
- Unauthenticated SQL injection to full admin access means an attacker can read every dashboard, query, and connected database credential in your Metabase instance.
- Source
- Metabase vendor advisory
Evidence trail
- NVD: View source
CVE-2026-6726
MSRCA spoofing bug in the TPM 2.0 reference implementation lets an attacker abuse improper object-slot reuse to undermine hardware trust guarantees. Microsoft has shipped Windows updates that address this for Azure Confidential Computing VM SKUs. If you're not running confidential VMs on Azure, you're likely not affected.
- Affected estate
- Teams running Azure Confidential Computing VMs (DCasv5, DCasv6, DCesv6, ECasv5, ECasv6 series)
- How to check
- Check your Azure VM SKU in the Azure Portal or with 'az vm show'. Confirm the VM series matches one of the affected SKUs listed above.
- Included because
- TPM trust boundary; affects confidential compute workloads; Microsoft has shipped a fix; CVSS 7.9
- Action
- Apply the latest Windows cumulative update to affected VMs. Validate TPM attestation health post-patch.
- Why it matters
- A spoofing bug in the TPM implementation can undermine the hardware-level trust that confidential computing relies on for workload isolation.
- Source
- Microsoft Security Update Guide, Trusted Computing Group
Evidence trail
- NVD: View source
CVE-2026-65819
MSRCA crafted network packet can trigger an out-of-bounds panic in the gopacket library's layer decoders, crashing any service that uses DecodingLayerParser. On Azure Linux 3.0, this hits Telegraf 1.31.0-28. An unauthenticated remote attacker can send malicious packets to cause a denial of service.
- Affected estate
- Azure Linux 3.0 operators running Telegraf 1.31.0-28, or anyone using gopacket's DecodingLayerParser in production services
- How to check
- Run 'tdnf list installed telegraf' on Azure Linux 3.0 to check the installed version. For custom Go services, check go.sum for the gopacket dependency version.
- Included because
- unauthenticated; remote DoS; CVSS 7.5; affects monitoring infrastructure
- Action
- Update Telegraf via 'tdnf update telegraf' or update the gopacket dependency in your Go projects and redeploy.
- Why it matters
- A single crafted packet can crash your monitoring agent or any service built on gopacket, causing a gap in telemetry or service availability.
- Source
- Azure Linux advisory
Evidence trail
- NVD: View source
CVE-2026-64901
NVDAn authenticated user can exploit a deserialization bug in SharePoint Server to run arbitrary code over the network. CVSS 8.8. This requires network access and a valid SharePoint account, but any authenticated user, not just admins, can pull it off. Not yet exploited in the wild, but SharePoint RCE bugs get weaponized fast.
- Affected estate
- SharePoint Server sysadmins running Subscription Edition, 2019, or 2016 Enterprise
- How to check
- Open SharePoint Central Administration > Upgrade and Migration > Check product and patch installation status. Compare your build number against the fixed version in the Microsoft advisory.
- Included because
- authenticated RCE; network-exploitable; CVSS 8.8; SharePoint is widely deployed and a common target
- Action
- Download and install the security update from the Microsoft Security Update Guide. Run the SharePoint Products Configuration Wizard after installation.
- Why it matters
- Any authenticated SharePoint user can achieve remote code execution on the server, which means a compromised or malicious user account becomes a full server compromise.
- Source
- Microsoft Security Update Guide
Evidence trail
- NVD: View source
One email, every Wednesday morning.
SubscribeFrom the field notes
From this beat
See every Patch Tuesday edition and post-mortem →