# Threat Intel Brief — August 10, 2026

TL;DR

  • Critical zero-days under active exploitation: Metabase SQL injection (CVSS 10.0) and N-able N-central authentication bypass (CVE-2026-18556, CVE-2026-18577) enable unauthenticated admin access and downstream compromise of managed endpoints.
  • Supply chain attack: Head Mare hacktivist group trojanized TrueConf video conferencing client installers after compromising distribution servers, delivering backdoors to end users.
  • Infrastructure at risk: CISA added Progress Kemp LoadMaster command injection (CVE-2026-8037) to KEV catalog following 792 exploitation attempts; CERT.BE warns of critical KVM VM escape vulnerabilities requiring immediate patching.
  • Novel attack vectors: Poland energy sector attacks exploited misconfigured private APN networks to reach OT systems; CSS-based webmail attacks demonstrated credential theft across Outlook, Gmail, and other major providers.

---

Critical Threats

Metabase Zero-Day SQL Injection (CVSS 10.0)

What happened: Metabase disclosed a maximum-severity zero-day vulnerability enabling unauthenticated remote attackers to inject arbitrary SQL into the application database via the /api/session/reset_password endpoint, gaining full administrative access. Active exploitation confirmed against Metabase Cloud and customer instances, including Framework (PC manufacturer) and Tally, resulting in data theft. Affected versions: 1.58.0 through 1.63.2 across all self-hosted and cloud deployments. CVE not yet publicly assigned.

Impact: Attackers achieve complete control over Metabase instances without authentication, enabling configuration changes, credential harvesting for connected databases, and data exfiltration. Framework breach exposed customer names, IP addresses, physical addresses, phone numbers, and email addresses. Organizations using Metabase for business intelligence face immediate risk of database compromise and sensitive data theft.

Recommendations:

  • Update self-hosted Metabase immediately to patched versions: 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, or 1.63.5
  • If patching is not immediately feasible, block /api/session/reset_password endpoint at firewall or reverse proxy
  • Hunt for compromise indicators: POST requests to /api/session/reset_password returning 400 status followed by GET /api/user/current returning 200 status
  • If compromise suspected: delete all core_session table rows, audit and remove unrecognized API keys, review admin account changes, rotate all connected database credentials
  • Review Metabase query history and data warehouse logs for unauthorized access since version 1.58.0 release

---

N-able N-central RMM Exploitation and Persistence

What happened: N-able confirmed active exploitation of authentication bypass vulnerabilities (CVE-2026-18556 and CVE-2026-18577, both CVSS 8.2) in N-central RMM product beginning July 31, 2026. Attackers achieved administrative access, used the Take Control feature to reach managed customer endpoints, and established persistence via Cloudflare Tunnel services that survive server remediation. CISA flagged both CVEs as actively exploited. CVE-2026-18577 represents an incomplete fix for CVE-2026-18556.

Impact: Full administrative compromise of N-central servers enables attackers to pivot to managed endpoints across MSP customer environments, creating supply-chain risk. Persistence mechanisms allow continued access even after patching the N-central server itself. Limited number of customers affected, but downstream impact extends to managed endpoints.

Recommendations:

  • Update on-premise N-central to version 2026.3.1.10 immediately; Hotfix 2 supersedes Hotfix 1 and is required even if prior hotfix was applied
  • Deploy N-able's custom service template to scan Windows endpoints for known indicators of compromise
  • Hunt for unauthorized Cloudflare Tunnel services registered on managed endpoints, particularly services created after July 31, 2026
  • Block or monitor outbound connections to IoC IP addresses: 173.249.252.176, 173.249.252.200, 185.156.46.150, 23.234.94.43, 37.153.90.88, 37.19.210.32, 68.235.46.214, 68.235.46.235, 87.249.138.34, 92.118.112.181
  • Review N-central administrative account activity and Take Control session logs for anomalous remote access between July 31 and present

---

TrueConf Supply Chain Compromise

What happened: Head Mare hacktivist group exploited vulnerabilities in unpatched TrueConf video conferencing servers to compromise software distribution infrastructure and replace legitimate client installers with backdoored versions. Users downloading TrueConf clients from compromised servers received trojanized software. CVE not yet publicly assigned.

Impact: Organizations that deployed TrueConf client installers from compromised distribution points may have installed backdoors on endpoints, granting attackers persistent access. Supply chain attacks bypass traditional perimeter defenses by leveraging trusted software distribution channels.

Recommendations:

  • Immediately verify integrity of all TrueConf server installations and apply latest vendor security patches
  • Hash-check all TrueConf client installers against known-good versions from official vendor sources; quarantine and reimage systems with mismatched hashes
  • Block network communications from TrueConf clients to unknown external IP addresses; monitor for command-and-control beaconing in firewall and proxy logs
  • Contact TrueConf vendor for indicators of compromise, affected server versions, and guidance on detecting trojanized installers
  • Implement application whitelisting and code signing verification to prevent execution of unauthorized installers

---

Progress Kemp LoadMaster Command Injection (CVE-2026-8037)

What happened: CISA added CVE-2026-8037, a critical command injection vulnerability in Progress Kemp LoadMaster (CVSS 9.6), to its Known Exploited Vulnerabilities catalog following reports of 792 active exploitation attempts across 41 days from 65 unique IP addresses spanning 18 countries. Unauthenticated remote attackers can execute arbitrary commands via unsanitized input in command endpoints.

Impact: Load balancers control application traffic flow and represent high-value targets for network pivoting, traffic interception, and denial of service. Compromise enables lateral movement and persistent access to critical infrastructure. Federal agencies must patch by August 10, 2026 per BOD 26-04.

Recommendations:

  • Apply Progress vendor patches for CVE-2026-8037 immediately on all Kemp LoadMaster appliances
  • Block inbound access to LoadMaster management interfaces from untrusted networks; restrict to dedicated management VLANs
  • Monitor for connections from known malicious IPs: 192.42.116.58, 192.42.116.105, 146.70.139.154
  • Review LoadMaster command logs for suspicious activity or unexpected command execution since June 2026
  • Implement network segmentation to limit lateral movement if LoadMaster appliances are compromised

---

KVM VM Escape Vulnerabilities

What happened: CERT.BE issued a critical warning regarding VM escape vulnerabilities in KVM (Kernel-based Virtual Machine) hypervisor requiring immediate patching. Specific CVE identifiers and affected versions not disclosed in advisory. Impacts organizations running KVM-based virtualization infrastructure on Linux hosts.

Impact: VM escape vulnerabilities allow attackers to break out of guest virtual machines and compromise the host hypervisor, potentially gaining control over all VMs on the affected system. This represents a complete breach of virtualization isolation boundaries. Critical risk for cloud providers, data centers, and any organization using KVM for workload isolation.

Recommendations:

  • Apply available security patches for KVM immediately on all Linux hypervisor hosts running virtualization workloads
  • Prioritize patching of multi-tenant KVM environments and systems hosting untrusted or customer-controlled VMs
  • Review KVM and kernel update channels for your Linux distribution (RHEL, Ubuntu, SUSE, Debian) and apply latest security updates
  • Monitor hypervisor logs for unusual VM behavior or unexpected host-level access attempts during and after patching
  • Verify patch application and reboot hypervisor hosts during maintenance windows if kernel updates require restart

---

Threat Actor Activity

Head Mare Hacktivist Group

Head Mare conducted supply chain attacks targeting TrueConf video conferencing infrastructure by exploiting unpatched server vulnerabilities to compromise software distribution channels. The group replaced legitimate client installers with trojanized versions containing backdoors, affecting downstream users who downloaded software from compromised servers. This represents a shift from direct endpoint targeting to upstream supply chain manipulation, maximizing impact through trusted distribution mechanisms.

---

Geopolitical Context

Poland Energy Sector Attacks

CERT.PL published a follow-up report on December 2025 attacks against Poland's energy infrastructure, revealing that a second combined heat and power plant was compromised alongside previously disclosed wind, solar, and CHP facilities. The three-month investigation identified a novel attack vector exploiting misconfigured private Access Point Name (APN) networks used for cellular connectivity to operational technology environments. Attackers leveraged arbitrary device-to-device communication enabled by APN misconfigurations to access industrial control systems and conduct destructive operations, including shutting down a steam turbine and water treatment system. CERT.PL assesses this APN misconfiguration is widespread domestically and internationally, elevating the incident from a national security concern to a systemic vulnerability affecting critical infrastructure globally. The purely destructive intent and timing during peak winter heating demand suggest strategic targeting consistent with state-sponsored activity, though no formal attribution has been published.

North Carolina Ports Cyberattack

The North Carolina Ports Authority confirmed a cyberattack on August 4, 2026, disrupting IT systems and operations across Port of Wilmington, Port of Morehead City, and Charlotte Inland Port. The incident forced system-wide outages and operational delays at facilities handling over 4.4 million short tons of cargo annually, representing significant disruption to U.S. East Coast maritime infrastructure and regional supply chains. No attribution or ransomware claims have been disclosed. The targeting of multiple interconnected facilities simultaneously suggests operational planning and familiarity with port IT architecture, consistent with either advanced ransomware operations or state-aligned reconnaissance and pre-positioning campaigns.

---

Recommended Actions

Immediate (0–24 hours)

  • Metabase: Patch to versions 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, or 1.63.5; if not possible, block /api/session/reset_password endpoint
  • N-able N-central: Update to version 2026.3.1.10 and deploy IoC scanning template to managed endpoints
  • Progress Kemp LoadMaster: Apply patches for CVE-2026-8037 and restrict management interface access
  • KVM: Apply available security patches on all Linux hypervisor hosts
  • TrueConf: Verify server patch status and hash-check all client installers against known-good versions

Within 24–72 hours

  • Banking malware campaign: Monitor for JavaScript and PowerShell execution chains from email attachments; implement endpoint detection for unauthorized proxy setting changes
  • Cryptocurrency clipboard hijacking: Deploy clipboard monitoring to detect wallet address substitution patterns across BTC, ETH, LTC, and other formats
  • N-central: Review administrative account activity and Take Control session logs for anomalous access since July 31, 2026
  • Metabase: If compromise suspected, rotate all connected database credentials and audit query history

This week

  • CSS webmail attacks: Review email security posture and isolate HTML email rendering in sandboxed iframes with strict Content Security Policy
  • Atlassian Rovo: Audit which apps and user groups have Rovo access enabled; restrict to business-critical users only
  • Private APN networks: Audit configurations to ensure device-to-device communication is restricted and segmented in OT environments
  • TrueConf: Implement application whitelisting and code signing verification to prevent execution of unauthorized installers

---

Watch List

  • Metabase CVE assignment: Monitor for public CVE identifier and additional technical details on SQL injection vector
  • N-able N-central: Track for additional IoCs and confirmation of patch effectiveness against evolving attacker techniques
  • KVM vulnerabilities: Await disclosure of specific CVE identifiers and affected version ranges from CERT.BE or upstream vendors
  • Poland energy sector: Monitor for formal attribution statements from Polish authorities or NATO/EU frameworks
  • CSS webmail attacks: Track vendor responses from Microsoft, Google, Yahoo, and AOL regarding Outlook label-jacking and Gmail image-set() bypass vectors demonstrated at Black Hat USA 2026
  • North Carolina Ports: Watch for attribution disclosures or ransomware claims related to August 4 incident

---

Sources

  • BleepingComputer: [Hackers breach TrueConf to trojanize client installers with backdoors](https://www.bleepingcomputer.com/news/security/hackers-breach-trueconf-to-trojanize-client-installers-with-backdoors/)
  • BleepingComputer: [Metabase SQLi zero-day exploited in customer data-theft attacks](https://www.bleepingcomputer.com/news/security/framework-tally-disclose-metabase-data-theft-attacks/)
  • BleepingComputer: [Real emails, hijacked payments: Two H1 2026 attack chains](https://www.bleepingcomputer.com/news/security/real-emails-hijacked-payments-two-h1-2026-attack-chains/)
  • BleepingComputer: [North Carolina Ports confirms cyberattack disrupting operations](https://www.bleepingcomputer.com/news/security/north-carolina-ports-confirms-cyberattack-disrupting-operations/)
  • BleepingComputer: [Levi Strauss & Co. says hackers stole corporate data in cyberattack](https://www.bleepingcomputer.com/news/security/levi-strauss-and-co-says-hackers-stole-corporate-data-in-cyberattack/)
  • The Hacker News: [Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication](https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html)
  • The Hacker News: [N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist](https://thehackernews.com/2026/08/n-central-attackers-reach-managed.html)
  • The Hacker News: [Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts](https://thehackernews.com/2026/08/progress-kemp-loadmaster-flaw-hits-cisa.html)
  • The Hacker News: [Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers](https://thehackernews.com/2026/08/atlassian-rovo-can-be-tricked-into.html)
  • The Hacker News: [New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens](https://thehackernews.com/2026/08/new-css-attacks-can-break-webmail.html)
  • CERT.BE: [Warning: VM Escape Vulnerabilities in KVM, Patch Immediately!](https://ccb.belgium.be/advisories/warning-vm-escape-vulnerabilities-kvm-patch-immediately)
  • CERT.PL: [Follow-Up Report of the December 2025 Energy Sector Incident](https://cert.pl/en/posts/2026/08/incident-follow-up-report-energy-sector-2025/)