Metabase Zero-Day, TeamCity RCE, and Gunra’s Fortinet Exploitation Lead This Week’s Vulnerability Priorities

                                                                                 By SAFE Threat Research Team 

This week’s exploitation activity spans enterprise analytics, CI/CD infrastructure, AI workflow platforms, application delivery, and enterprise edge infrastructure. Metabase disclosed an actively exploited zero-day vulnerability, now tracked as CVE-2026-72898, following attacks against its cloud environment. The unauthenticated SQL injection can provide administrator access to Metabase and expose credentials and data from connected databases. The JetBrains TeamCity unauthenticated RCE vulnerability, CVE-2026-6307, is also being actively exploited, exposing server configuration, stored credentials, and downstream CI/CD workflows.

At the enterprise edge, Gunra ransomware operators are exploiting CVE-2024-55591 and CVE-2025-24472 in FortiOS and FortiProxy for initial access, followed by credential theft, lateral movement, data exfiltration, and ransomware deployment. At the other end of the vulnerability timeline, SideWinder continues to exploit CVE-2017-0199, a Microsoft Office vulnerability patched in 2017, in targeted spear-phishing operations against government, defense, and diplomatic organizations across South Asia.

IBM Langflow, Progress LoadMaster, and Apache Tomcat further confirm exploitation across AI workflow, application delivery, and middleware infrastructure. The technical impact varies considerably across these vulnerabilities, making the access gained after exploitation, the affected system’s role, and the asset’s reachability within the wider environment important factors in determining remediation priority.

Vulnerability Landscape

This week, NVD published 2,317 CVEs, including 886 rated critical or high severity. Public exploit or proof-of-concept code was available for 162 vulnerabilities, while 9 showed stronger weaponized-exploit signals.

Disclosure volume establishes the scale of the vulnerability landscape, but the technical conditions behind individual findings differ substantially. An unauthenticated RCE on an exposed CI/CD server, a configuration-dependent encryption bypass in a Tomcat cluster, and a client-side vulnerability requiring user interaction should not receive the same remediation priority.

Trending Vulnerabilities

This week, eight CVEs showed confirmed exploitation activity, including two newly published vulnerabilities and six pre-existing CVEs.

The split reflects both ends of the exploitation window. Newly disclosed vulnerabilities, such as CVE-2026-72898, can enter active exploitation before defenders have had significant time to respond, while older flaws such as CVE-2017-0199 continue to appear in current campaigns years after fixes became available.

Top CVEs to Watch

Metabase CVE-2026-72898: Zero-Day SQL Injection Enables Administrator Access 

Metabase disclosed a maximum-severity SQL injection vulnerability after detecting exploitation against its Cloud environment using a previously unknown zero-day. The vulnerability is assigned CVE-2026-72898 and tracked as GHSA-vwf4-m7j8-wcjf, with a CVSS score of 10.0. The flaw is exploited via the unauthenticated /api/session/reset_password endpoint, where manipulation of the user-id parameter allows a remote attacker to inject arbitrary SQL without valid credentials or user interaction, potentially granting full administrator access to the Metabase instance.

The impact extends beyond Metabase itself because the platform stores credentials and connects to enterprise databases and cloud data warehouses, including PostgreSQL, MySQL, Microsoft SQL Server, Snowflake, Google BigQuery, and Amazon Redshift. An attacker with administrator access can modify configuration, create persistent accounts and API keys, recover connected database credentials, and access or export data. Metabase confirmed that its Cloud environment was exploited as a zero-day before disclosure and has since been patched; a publicly disclosed victim also reported unauthorized access to customer information.

Organizations running self-hosted Metabase should immediately upgrade to 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5, as applicable, or the corresponding Enterprise releases. Where immediate upgrading is not possible, access to /api/session/reset_password should be restricted. Previously exposed instances should be investigated for suspicious administrator activity, API keys, active sessions, connected database access, and the reported request pattern associated with exploitation. 

JetBrains TeamCity CVE-2026-63077: Unauthenticated RCE Threatens CI/CD Integrity

CVE-2026-63077 is a critical unauthenticated remote code execution vulnerability affecting TeamCity On-Premises. An attacker with HTTP or HTTPS access to a vulnerable TeamCity server can exploit the agent polling protocol to bypass authentication and execute arbitrary operating system commands with the privileges of the TeamCity server process. All TeamCity On-Premises versions prior to the fixed releases are affected; the issue has already been mitigated in TeamCity Cloud.

Active and attempted exploitation against unpatched TeamCity servers has now been confirmed. Depending on the privileges available to the TeamCity service, successful exploitation can expose project data, server configuration, and stored credentials, alter server state, and potentially compromise build artifacts or downstream CI/CD pipelines.

Organizations should upgrade to TeamCity 2025.11.7 or 2026.1.3, or install the security patch plugin available for TeamCity 2017.1 and later. Investigation should include searches for com.thoughtworks.xstream.converters.ConversionException and unexpected unauthorized build agents, particularly those whose names begin with “scan”. On systems that were already patched, ForbiddenClassException may indicate that an exploitation attempt was blocked.

IBM Langflow CVE-2026-9198: Auto-Login and Code Validation Chain Enables Pre-Auth RCE

CVE-2026-9198 is a critical code-injection vulnerability affecting Langflow OSS versions 1.0.0 through 1.10.0. The exploit chains two application behaviors: /api/v1/auto_login can issue a SUPERUSER bearer token to an unauthenticated network caller, and that token can then be used against /api/v1/validate/code, which executes submitted Python through exec().

The validator executes decorators, default arguments, and annotations while defining functions, allowing attacker-controlled code to run on the underlying host. On affected default deployments, the chain therefore moves directly from unauthenticated network access to arbitrary command execution without requiring an existing account or user interaction. CVE-2026-9198 was added to CISA KEV following evidence of active exploitation.

Organizations should upgrade to Langflow 1.10.1 or later and investigate previously exposed instances for unexpected process execution, administrative activity, modified flows, newly created credentials, and access to secrets or external services available to the Langflow process.

Progress LoadMaster CVE-2026-8037: Pre-Authentication Command Injection Targets Application Delivery Infrastructure

CVE-2026-8037 is a critical command-injection vulnerability affecting Progress LoadMaster and related ADC products. Improper handling of user-controlled input in the affected API/UI paths can allow an unauthenticated attacker to execute arbitrary operating-system commands on the appliance. The vulnerable path includes the cipher-set management functionality.

Public exploit code became available after disclosure, and exploitation attempts were subsequently observed against vulnerable appliances. CISA added CVE-2026-8037 to the Known Exploited Vulnerabilities catalog on August 7.

The issue is fixed in LoadMaster 7.2.63.2 for the GA branch and 7.2.54.18 for LTSF. Because LoadMaster operates as an application delivery controller, the response should include more than version verification where the vulnerable API was reachable. Review appliance configuration, administrative activity, unexpected command execution, and changes affecting traffic-management or application-delivery settings.

Microsoft Office CVE-2017-0199: SideWinder Reuses a 2017 RCE in an Ongoing South Asia Espionage Campaign

CVE-2017-0199 is a remote code execution vulnerability affecting Microsoft Office and WordPad. SideWinder continues to use the flaw as part of an ongoing spear-phishing operation targeting government, defense, and diplomatic organizations across Bangladesh, Sri Lanka, Nepal, and Pakistan. The current campaign has used more than 60 government and institutional impersonation subdomains across 11 parent domains.

One observed delivery chain uses weaponized DOCX files containing an OLE2Link exploit for CVE-2017-0199. When the document is opened, the exploit contacts attacker-controlled infrastructure to retrieve remote content. The campaign operates alongside a separate remote-template delivery mechanism using weaponized DOCX and PDF files, allowing the actor to vary the document-based attack path while targeting the same organizations.

The continued operational use of a vulnerability patched in April 2017 is particularly relevant in environments that retain unsupported or incompletely patched Office installations. Security teams should verify deployment of fixes for CVE-2017-0199 and the related CVE-2017-11882, restrict automatic retrieval of remote templates and linked content, enforce Protected View for internet-origin files, and detect Office documents containing external OLE relationships.

Fortinet FortiOS CVE-2024-55591, CVE-2025-24472: Gunra Ransomware Uses Authentication Bypass for Initial Access

CVE-2024-55591 and CVE-2025-24472 are authentication-bypass vulnerabilities affecting FortiOS and FortiProxy. CVE-2024-55591 can allow an unauthenticated attacker to obtain super-admin privileges through crafted WebSocket requests, while CVE-2025-24472 provides a separate bypass through crafted CSF proxy requests.

Recent ransomware activity links both vulnerabilities to Gunra, which has exploited internet-facing Fortinet infrastructure for initial access before conducting credential theft, lateral movement, data exfiltration, and ransomware deployment. Post-compromise activity has included Impacket tooling, pass-the-hash/pass-the-ticket techniques, SSH tunneling, and collection of data from OneDrive and SharePoint.

Organizations should upgrade affected FortiOS and FortiProxy deployments, restrict administrative interfaces from untrusted networks, and investigate previously exposed devices for unauthorized administrator access, configuration changes, suspicious VPN sessions, SSH tunnels, and downstream lateral movement.

Apache Tomcat CVE-2026-34486: EncryptInterceptor Bypass Moves Into Active Exploitation

CVE-2026-34486 is an Important-severity missing-encryption vulnerability affecting specific Apache Tomcat releases. An error in the remediation of CVE-2026-29146 allows bypassing the EncryptInterceptor used for encrypted communication between Tomcat cluster nodes. The affected upstream releases are Tomcat 11.0.20, 10.1.53, and 9.0.116.

The vulnerability has been added to CISA KEV following confirmed exploitation. Recent attack telemetry included attempts against Tomcat servers as part of a broader campaign in which attackers maintained exploit tooling across several enterprise products. Organizations should upgrade to 11.0.21, 10.1.54, or 9.0.117 or later, depending on the branch they have deployed. Exposure assessment should first identify clusters that are actually using the affected EncryptInterceptor functionality and evaluate the network trust boundary for inter-node cluster traffic.

macOS CVE-2026-65400: Screen Sharing Authentication Bypass Enables Pre-Auth Root Access

CVE-2026-65400 is an authentication vulnerability in the macOS Screen Sharing service. A flaw in Secure Remote Password handling can cause a malformed connection to be treated as authenticated, allowing a network attacker to establish a Screen Sharing session without valid credentials. Apple fixed the issue in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.

Successful exploitation can expose privileged Screen Sharing helper processes running with root permissions, enabling arbitrary file operations and a path to remote code execution. Persistence can also be established so that attacker-controlled code executes after reboot or subsequent user activity. The attack does not depend on legacy VNC password authentication or preconfigured Screen Sharing user accounts.

Exposure requires Screen Sharing to be enabled and network-reachable. Organizations should update supported Macs to the fixed releases or disable/restrict Screen Sharing where immediate patching is not possible. Systems that exposed the service while vulnerable should be reviewed for unexpected Screen Sharing sessions and privileged file activity associated with Screen Sharing helper processes.

What Security Teams Should Prioritize

This week’s exploited vulnerabilities span systems with very different roles in the enterprise, from analytics and CI/CD platforms to firewalls, application delivery infrastructure, AI workflows, and endpoint software. The remediation sequence should reflect both the conditions under which the exploit is executed and the access available after compromise.

• Prioritize confirmed exploitation on externally reachable systems. Metabase, TeamCity, Langflow, LoadMaster, and affected Fortinet infrastructure warrant immediate attention, where vulnerable services or management interfaces were reachable during the exploitation window.
• Assess the systems and data accessible through the vulnerable platform. Metabase may expose connected databases; TeamCity can hold build credentials and artifacts; Langflow can access application secrets and integrations; and compromised Fortinet appliances can provide an initial foothold for broader intrusion activity.
• Perform a compromise assessment where patching follows exploitation. Review administrative accounts, credentials, sessions, configuration changes, unexpected processes, persistence mechanisms, and downstream activity rather than treating installation of a fixed version as the end of the response.
• Keep current threat activity attached to older findings. SideWinder’s continued use of CVE-2017-0199 makes the vulnerability relevant to organizations that still have affected Office deployments, irrespective of its disclosure age.

This week also illustrates why the context of vulnerability changes the remediation decision. A CVSS 10 vulnerability in an isolated asset, a lower-severity flaw in an exposed management plane, and a legacy CVE being used in a current espionage campaign do not present the same operational priority.

SAFE CTEM provides a consistent way to make those distinctions at scale. SAFE aggregates findings into a unified exposure model and enriches them with exploit signals, KEV, threat intelligence, asset criticality, and business context. Its Finding Score evaluates access, threat, impact, and compensating controls, helping teams move beyond scanner severity when determining fix order.

Once priorities are established, SAFE connects them to action through ownership routing, ticketing, patch-job integration, exception management, and remediation-status synchronization.

The value is in preserving the reasoning behind the priority from finding to fix: why an exposure matters, what needs to happen next, and whether the teams responsible for it have a clear path.