Daily Security Roundup: 0-Days, CVEs, and Hardware Flaws (Aug 11, 2026)

Forum topic · ✨步子哥 · 2026-08-11

Summary

A 24-hour vulnerability digest covering active 0-days, high-severity CVEs, and hardware defects disclosed or exploited around August 11, 2026. Top items include a Metabase unauthenticated SQL injection (GHSA-vwf4-m7j8-wcjf, CVSS 10.0) affecting self-hosted v0.58–v0.63 / v1.58–v1.63, with public exploits and thousands of exposed instances; Check Point SmartConsole authentication bypass CVE-2026-16232 (CVSS 9.3) now in CISA KEV; and a CISA Week-of-Aug-3 batch featuring Azure SQL Database, Microsoft Teams, Planetary Computer Pro, and Microsoft Entra privilege-escalation flaws (CVSS 9.9–10.0), plus Kata Containers host code execution, Keysight IxChariot unauthenticated RCE, SonicWall SMA1000, and N-able N-central auth bypass with in-the-wild exploitation. On the hardware side, HD Moore's Black Hat research shows ~86,000 internet-exposed BMCs (HPE iLO, Dell iDRAC, Supermicro IPMI, OpenBMC), over half carrying critical flaws, with legacy CVE-2013-4786 still impacting ~75,000 devices. Actionable patching and hardening steps are provided.

Key Points

Software 0-Days and Active Exploitation

Metabase unauthenticated SQL injection (Critical, CVSS 10.0)

Advisory: GHSA-vwf4-m7j8-wcjf (no CVE assigned as of 2026-08-10)
Affected: self-hosted OSS v0.58–v0.63 and Pro/Enterprise v1.58–v1.63. Metabase Cloud has been auto-patched; self-hosted instances remain exposed.
Mechanism: unauthenticated attackers can inject arbitrary SQL via POST /api/session/reset_password and escalate to admin, exfiltrating connected database credentials and data.
Active exploitation confirmed; Framework Notebooks and Tally reported customer PII exposure. Public PoC exists; roughly several thousand instances are estimated to be exposed.
Fixed in: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5.
Forensics trail: HTTP 400 on POST /api/session/reset_password immediately followed by HTTP 200 on GET /api/user/current.

Check Point SmartConsole authentication bypass (Critical, CVE-2026-16232, CVSS 9.3)

Added to CISA KEV on 2026-07-22.
Unauthenticated attackers obtain an application login token and gain full admin on the management server.
High risk only when the management console is directly internet-exposed without Trusted Clients restrictions. Limited customer impact reported.
Patches: Jumbo HotFix R81.20 Take 158 / R82 Take 118 / R82.10 Take 36.
Forensics trail: audit log entries containing Authentication method: application token.

CISA "Week of August 3" bulletin (sb26-222) and recent KEV entries | Product | CVE | CVSS | |---|---|---| | Azure SQL Database (privilege escalation) | CVE-2026-56162 | 10.0 | | Microsoft Teams (privilege escalation) | CVE-2026-65667 | 10.0 | | Planetary Computer Pro (privilege escalation) | CVE-2026-63508 | 10.0 | | Microsoft Entra (privilege escalation) | CVE-2026-50481 | 9.9 | | Kata Containers (host code execution) | CVE-2026-50540 | 9.6 | | Keysight IxChariot (unauthenticated RCE) | CVE-2026-49435 | 9.8 | | SonicWall SMA1000 | CVE-2026-15409 | 10.0 | | N-able N-central (auth bypass, in KEV) | CVE-2026-18577 | 8.2 |

Kata Containers CVE-2026-50540 (fixed in 4.0.0): an unchecked io.katacontainers.config_path annotation loads a host TOML and enables host root code execution.
Keysight IxChariot CVE-2026-49435: stack overflow enabling single-packet, admin-level RCE across IxChariot / Hawkeye / IxTap / IxProbe / IxByPass.
N-able N-central CVE-2026-18577 (KEV 2026-08-03): incomplete fix for CVE-2026-18556, allowing admin takeover; in-the-wild exploitation observed.

Hardware Vulnerabilities and Defects

Baseboard Management Controllers (BMC) – mass exposure

runZero's HD Moore at Black Hat revealed widespread flaws in HPE iLO, Supermicro IPMI, Dell iDRAC, and OpenBMC, some tracing back to the 2013 IPMI 2.0 authentication flaw CVE-2013-4786, which still impacts ~75,000 devices with offline-crackable passwords.
~86,000 internet-exposed BMCs; 54% carry at least one critical flaw.
~126,000 BMCs observed on internal scans; 29% vulnerable.
Successful exploitation bypasses the OS, enabling out-of-band server control, persistence, and lateral movement.
Vendor patches and full CVE disclosures are still being coordinated. Immediate actions: inventory BMC exposure, restrict management networks, enforce strong authentication, monitor, and disable unnecessary IPMI/KCS interfaces.

Other hardware notes: Linux kernel received use-after-free and other privilege-escalation fixes; chipset/firmware side-channel and debug-interface issues remain under scrutiny, but no catastrophic new physical defects were disclosed in the past 24 hours.

Recommended Actions

Metabase: upgrade self-hosted instances immediately; block non-essential admin endpoints; rotate connected-database credentials and audit logs.
BMC / out-of-band management: network segmentation, strong authentication, vendor advisory tracking, exposure inventory.
Check Point / SonicWall / N-able: apply Jumbo HotFix or vendor patches per version; restrict management-plane internet exposure.
Microsoft cloud products: prioritize the August Patch Tuesday batch of CVSS 10.0 privilege-escalation fixes.
Process: track CISA KEV and vendor advisories; triage actively exploited items first.
Logging: monitor for abnormal authentication, SQL-injection indicators, and management-interface access.

> Security is a thin-ice walk; patching early is always better than late. The above is synthesized from public intelligence; refer to official vendor advisories for authoritative detail.