Cloud roundup: LoadMaster RCE hits its KEV deadline today

If you run a Progress/Kemp LoadMaster load balancer, today’s the deadline. Beyond that, it’s a quieter day — another max-severity zero-day to know about, a bad update on last week’s N-central saga, and AWS chipping away at supply chain risk.

Progress LoadMaster command injection hits its remediation deadline today

CISA added CVE-2026-8037 (CVSS 9.6), an unauthenticated command injection flaw in Progress (Kemp) LoadMaster, to the KEV catalog on August 7 after eSentire and watchTowr Labs both reported active exploitation attempts — 792 reported attempts by one count (The Hacker News). The bug lives in a function called escape_quotes() and lets an unauthenticated attacker send unsanitized input to a LoadMaster API endpoint and get arbitrary command execution on the appliance. Progress shipped the fix back in June (GA 7.2.63.2 / LTSF 7.2.54.18), so this is really about finding the load balancers your org forgot to patch. Federal civilian agencies have until today, August 10, to remediate under BOD 26-04 — if you run LoadMaster anywhere with its management API exposed, that’s your action item regardless of whether you’re a federal shop.

A CVSS 10 zero-day in Metabase, no CVE yet

Metabase — a popular open-source BI/dashboarding tool a lot of teams point at production databases — has a maximum-severity, unauthenticated SQL injection zero-day being actively exploited in the wild, including against Metabase Cloud itself (The Hacker News). An attacker can inject SQL through the app database with no credentials and land admin access, which means the credentials for every database Metabase is connected to are exposed too. It affects the 1.58 through 1.63 release lines; patched builds are out (1.58.24 through 1.63.5). If you can’t patch immediately, block the /api/session/reset_password endpoint at your edge as a stopgap, then rotate the DB credentials Metabase held once you’re patched — assume they were seen.

N-able N-central: the first patch wasn’t enough

An update to the N-central story from earlier this week: N-able shipped Hotfix 2 after finding attackers who’d exploited CVE-2026-18577 were registering Cloudflare Tunnel connections on compromised managed endpoints to keep access even after the N-central server itself got locked down (The Hacker News). If you patched with Hotfix 1 and called it done, it’s worth another look — N-able is now shipping expanded IOCs and a detection template, and explicitly warning that a clean scan doesn’t guarantee you weren’t hit. Good reminder that “authentication bypass” bugs on management platforms deserve a persistence hunt, not just a patch-and-move-on.

AWS Security Hub Extended adds supply chain security

AWS added supply chain security as the tenth category in Security Hub Extended, with Chainguard and Socket as the curated partners, aimed at catching malicious code in open-source dependencies before it gets built into your app (AWS). It’s pay-as-you-go with no commitment, and findings land in the same OCSF-normalized dashboard as everything else in Security Hub. If you’re already paying for Extended and doing dependency scanning with a separate standalone tool, worth comparing — consolidating that signal into the same place as your other findings is generally a win for whoever’s triaging.

Bottom line

Patch LoadMaster today if you run one exposed. If you’re on Metabase, patch and rotate credentials — assume compromise until proven otherwise. And if you touched N-central last week, go back and hunt for persistence rather than trusting the first patch.