breach
Week in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-day
A zero-day vulnerability in the Metabase business intelligence service has been exploited to access customer data from Framework, a San Francisco-based laptop manufacturer. The breach exposed names, email addresses, phone numbers, physical addresses, and login IP addresses of affected Framework customers. Payment information and order records were not compromised.
CVE-2026-20349
U.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to address these flaws due to active exploitation. The vulnerabilities affect Metabase, Microsoft Windows, and Cisco Secure Firewall products.
CVE-2026-20349critical
U.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to address them promptly. The newly cataloged flaws include a critical SQL injection vulnerability in Metabase, a use-after-free flaw in Microsoft Windows' Ancillary Function Driver for WinSock, and a heap…
vulnerability
Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius
Reports indicate that a zero-day vulnerability affecting the Metabase business-analytics platform is actively being exploited. This flaw, described as having maximum severity, permits remote attackers to gain administrator-level access. The lack of a Common Vulnerabilities and Exposures (CVE) identifier suggests it is a newly discovered or unpatched issue, potentially limiting the immediate…
breach
Metabase zero-day exploited to access Framework customer data
Framework, a San Francisco-based laptop manufacturer, has confirmed a data breach stemming from a zero-day vulnerability in the Metabase business intelligence service. The incident led to unauthorized access to customer names, email addresses, phone numbers, physical addresses, and login IP addresses. Framework clarified that payment information and order records were not compromised.
vulnerabilityhigh
Metabase Zero-Day Exploited in the Wild, Exposing Admin Access and Sensitive Data
Attackers have exploited a zero-day vulnerability in Metabase, an open-source business intelligence and data analytics platform, to gain administrative access and steal sensitive data. The flaw, which carries a maximum CVSS score of 10.0, allowed unauthenticated attackers to inject arbitrary SQL into the Metabase application database.
CVE-2023-38646critical
Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
Metabase has issued a critical alert regarding a zero-day vulnerability in its business intelligence software that is actively being exploited in the wild. The flaw reportedly allows unauthenticated attackers to achieve administrator access, facilitating credential theft and data exfiltration. Metabase Cloud instances have been patched, and self-hosted users are urged to update their…
breachcritical
Metabase SQLi zero-day exploited in customer data-theft attacks
Metabase, a business intelligence software provider, has disclosed that a critical SQL injection vulnerability, previously unknown, was exploited in zero-day attacks to compromise customer instances and steal data. The company confirmed that its Metabase Cloud SaaS platform was affected, and self-hosted installations running versions 1.58 and above were also vulnerable.
