Another week, another parade of remotely reachable disasters dressed up as “security updates.” If your patch queue feels like a hostage situation, congratulations: you are experiencing modern IT.
This Week's Hall of Shame: Top CVEs
CVE-2026-20349 — Cisco’s VPN reboot button, now internet-accessible
The Gist: Cisco Secure Firewall ASA and FTD have a high-severity flaw in the Remote Access SSL VPN service that lets an unauthenticated remote attacker crash the device with a crafted HTTP request. It’s CVSS 8.6, network-exploitable, requires no auth, and it’s already being exploited in the wild.
Why It Should Keep You Up at Night: This is the kind of bug that turns your edge security appliance into a self-own machine. If your VPN gateway can be kicked over by strangers on the internet, your “secure remote access” strategy starts looking less like defense-in-depth and more like performance art.
Your Playbook:
- Patch affected Cisco ASA and FTD systems to the fixed releases listed by Cisco, especially any internet-facing SSL VPN deployments.
- If you can’t patch immediately, restrict exposure to the Remote Access SSL VPN service, monitor for unexpected device reloads, and hunt for suspicious crafted HTTP traffic hitting the VPN interface.
Sources: Rapid Risk Radar | Cisco Security Advisories | CISA Known Exploited | VulnCheck KEV
CVE-2026-72898 — Metabase forgot SQL injection was bad
The Gist: Metabase is dealing with a maximum-chaos CVSS 10.0 SQL injection flaw in the /reset_password database endpoint. A remote, unauthenticated attacker can inject arbitrary SQL and gain administrator access to the connected Metabase instance, and yes, it’s being exploited in the wild.
Why It Should Keep You Up at Night: This is not some obscure edge case buried behind six layers of wizardry; it’s unauthenticated SQL injection on a password reset path. In 2026, shipping that is like leaving your front door open and calling it “frictionless onboarding.”
Your Playbook:
- Update Metabase immediately to the vendor-fixed version referenced in the security update, and prioritize any externally reachable instances.
- Assume exposed systems may be compromised: rotate Metabase admin credentials, review connected database access, and investigate for suspicious password reset and SQL activity.
Sources: Rapid Risk Radar | CISA Known Exploited | Wiz Blog | VulnCheck KEV
CVE-2026-62878 — Windows DNS, because the network needed more drama
The Gist: Microsoft patched a critical stack-based buffer overflow in Windows DNS that could allow unauthorized remote code execution over the network. It carries a CVSS 9.8, needs no authentication or user interaction, and while it’s not known to be exploited yet, it has all the ingredients for a very bad week.
Why It Should Keep You Up at Night: DNS is one of those services you really don’t want turning into an attacker trampoline. A wormable-looking bug in core infrastructure is how defenders end up stress-eating granola bars in a conference room while someone says “containment” far too many times.
Your Playbook:
- Apply Microsoft’s August security updates to affected Windows DNS servers as a priority, especially on critical internal infrastructure.
- Segment and closely monitor DNS servers for anomalous traffic or crashes, and validate that only required systems can reach them over the network.
Sources: Rapid Risk Radar | MSRC Security Updates | CrowdStrike Blog | HelpNetSecurity
Industry Intel: What Else is On Fire This Week
-
Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws — Adobe once again reminds everyone that “enterprise software” and “calm weekend” remain mutually exclusive. Read more
-
Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access — Because apparently some attackers saw “virtualization management plane” and thought, yes, that should absolutely be my forever home. Read more
-
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations — Supply chain security continues its long-running tradition of turning one compromise into everyone’s group project. Read more
Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.