InfoSec.Watch - Issue #150

N-able made a second remediation step mandatory on August 6 for the N-central incident it disclosed days earlier. The company says a threat actor had been actively exploiting a previously unknown flaw, now tracked as CVE-2026-18577, against on-premises N-central. Hotfix 2, version 2026.3.1.10, supersedes the first hotfix and is required even for customers that already installed it. N-able Hosted environments were updated by the company.

The more important detail is what happened after access. N-able says attackers gained remote administrative access on vulnerable systems, then used N-central’s legitimate Take Control capability to reach managed endpoints. The actor also installed a Cloudflare tunnel service for persistence. That turns an RMM compromise into a potential control-plane event rather than a single-server patch problem. On-premises customers should upgrade immediately, review N-able’s indicators and detection guidance, and investigate remote-control activity and persistence on systems administered through N-central—not just the N-central server itself.

Sources: N-able incident update · N-central Hotfix 2

Metabase disclosed an actively exploited, unauthenticated SQL-injection vulnerability on August 6 after attacks against Metabase Cloud. The maintainer says an attacker can inject arbitrary SQL into the Metabase application database, obtain administrator access, change configuration, steal credentials for connected databases, and read or export data those connections can reach. Metabase Cloud has already been patched; self-hosted deployments need to upgrade to a fixed release for their branch immediately.

There is no CVE assigned in the maintainer’s advisory as of this issue. That is operationally important: waiting for a CVE, KEV entry, or scanner signature would lag the risk. Metabase recommends revoking sessions where appropriate, reviewing API keys and administrator changes, rotating connected-database credentials, and checking both Metabase activity and warehouse logs. The advisory also provides a specific request pattern involving /api/session/reset_password followed by /api/user/current that can help identify likely compromise.

Sources: Metabase security update · GitHub Security Advisory GHSA-vwf4-m7j8-wcjf

Google Threat Intelligence Group says a financially motivated cluster it tracks as UNC6671 is using helpdesk-style voice phishing to compromise enterprise cloud accounts and steal data for extortion. Operators call employees—sometimes on personal phones—spoof legitimate helpdesk numbers, and direct victims to attacker-controlled sign-in pages using adversary-in-the-middle tooling. One current lure is an urgent request to enroll or migrate a FIDO2 passkey or other MFA method.

The passkey detail is easy to misread. GTIG is not describing a break in FIDO2. The attacker is abusing the migration conversation to capture credentials and session material before a legitimate phishing-resistant control is established. After access, GTIG says the operators use automation to exfiltrate data from Microsoft 365 and Okta and may remove reset or security notifications to reduce visibility. Defenders should treat unsolicited MFA or passkey enrollment support as a high-risk helpdesk event and tighten identity-change verification, session revocation, and bulk-data monitoring.

Source: Google Threat Intelligence Group / Mandiant

CISA added Progress LoadMaster CVE-2026-8037 to the Known Exploited Vulnerabilities catalog on August 7. The flaw is an unauthenticated OS command-injection path in LoadMaster management interfaces that can lead to remote code execution. Progress lists fixes in LMOS 7.2.63.2 and 7.2.54.18. Internet-facing or externally reachable appliances should be treated as priority patch-and-hunt targets.

Sources: CISA KEV alert · Progress LoadMaster vulnerabilities

JetBrains materially updated its TeamCity guidance on August 7: CVE-2026-63077, which Issue #149 covered before known exploitation, is now seeing reports of active and attempted exploitation against unpatched servers. The unauthenticated flaw can execute commands through the agent polling protocol. Upgrade to TeamCity 2025.11.7 or 2026.1.3, or use JetBrains’ security patch plugin where applicable, then review the published investigation indicators.

Sources: JetBrains August 7 follow-up · Original TeamCity advisory

CISA published five flaws in the ATN-B1 Controller–Pilot Data Link Communications protocol, CVE-2025-71409 through CVE-2025-71413. Researchers demonstrated message injection, forced disconnects, false status messages, and repeated resets over radio links. This is not an active-exploitation story: CISA says the attacks require very specific conditions and are unlikely outside a lab. The signal is the security debt in trusted operational protocols.

Source: CISA ICSA-26-219-01

This week’s pattern is not simply “privileged platforms are dangerous.” It is that the blast radius now follows legitimate automation. N-able N-central’s Take Control function gave an intruder a built-in path from the management server to endpoints. Metabase could turn one application compromise into access across connected data stores because the platform already holds the credentials and query paths. UNC6671 similarly moves from a stolen cloud session to automated collection across Microsoft 365 and Okta. TeamCity adds the same concern on the software-delivery side. Defenders need to model not only what a compromised identity can access, but what the platform can automatically do at scale once that identity or service is under attacker control.

Action: Run a controlled “fan-out containment” test for one high-blast-radius management platform. Assume an administrator session is compromised and time how quickly you can stop its ability to reach downstream systems, revoke active sessions or tokens, and block further bulk actions. Use N-central, Metabase, your identity platform, or TeamCity as the test case based on exposure.

Who runs it: Security engineering and the SOC with the platform owner; include IAM for identity/session controls and infrastructure or DevOps where the selected platform manages endpoints or build systems.

Check these specifically: For N-central, admin and Take Control activity plus unexpected services or Cloudflare tunnels. For Metabase, password-reset activity, API keys, administrator changes, connected-database identities, and warehouse query logs. For Microsoft 365/Okta, MFA or passkey enrollment changes, session revocation, and unusual bulk downloads. For TeamCity, unauthorized agents and JetBrains’ published log indicators.

Evidence you're done: A timed test record showing detection-to-containment time; saved queries or screenshots proving the relevant sessions, remote-control path, or bulk action was stopped; a documented kill-switch/runbook; and a ticket listing any credential, network, or alerting gaps found during the drill.

Least privilege is necessary, but it is not enough for systems built to act on behalf of many users, endpoints, pipelines, or databases. Those platforms are valuable precisely because one authorized action can reach farther than a human could manually. The same efficiency becomes an attacker multiplier after compromise.

A useful control question is therefore: if this console, session, or service identity were taken over right now, what is the fastest reliable way to stop its fan-out? If the answer depends on finding the right person during an incident, rebuilding the process from memory, or discovering downstream credentials after the fact, the blast radius is already larger than the architecture diagram suggests.