Welcome back! August brought another busy month for cloud security, with actively exploited vulnerabilities and software supply chain attacks once again taking center stage. We bring you the latest cloud security highlights to help you stay informed and stay secure.
Throughout August 2026, Wiz Threat Research tracked several critical vulnerabilities under active exploitation, including flaws affecting Metabase, N-able N-central, and MLflow, alongside significant authentication and RCE risks in widely used technologies such as Keycloak and WordPress. Software supply chain threats also remained prominent, with attackers compromising trusted open source packages and maintainer accounts across both the npm and Rust ecosystems. Most notably, the keyv/cacheable compromise propagated to more than 400 npm packages, demonstrating how quickly a single compromised maintainer identity can have widespread downstream impact.
✨Highlights
Multiple npm Packages Hijacked in Supply Chain Attack
Multiple npm packages in the keyv/cacheable ecosystem were compromised following the compromise of a GitHub maintainer account, resulting in the publication of malicious package versions. All versions shared a consistent payload. Starting at 9:00 UTC, the attacker first used a compromised identity to introduce IDE persistence payloads to the keyv repository, and then shortly after published a new version of keyv containing their payload. This worm has since propagated to over 400 distinct npm packages.
Learn more in our blog.
Critical SQL Injection Vulnerability in Metabase Exploited in-the-Wild
Metabase has disclosed a critical SQL injection vulnerability (CVE-2026-72898) affecting self-hosted Metabase instances running version 0.58 and later. The flaw allows an unauthenticated attacker to inject arbitrary SQL into the Metabase application database, potentially leading to full administrator access, theft of stored database credentials, unauthorized access to connected data sources, and data exfiltration. Metabase has confirmed that the vulnerability is being actively exploited in the wild and urges affected users to upgrade immediately.
Learn more in our blog.
🐞 High Profile Vulnerabilities
Unauthenticated Account Takeover Vulnerability in Keycloak
Keycloak has disclosed an authentication bypass vulnerability allowing account takeover via the password reset flow (CVE-2026-18963). Initially reported as affecting only Red Hat builds, the maintainers have confirmed that the bug exists upstream. Exploitation requires the application to have the reset password flow enabled, and the attacker must know the target's username. However, in our estimation this isn't a challenging requirement, as such information can be found in many publicly available infostealer logs and data leaks.
According to Wiz data, less than 5% of cloud environments have resources vulnerable to this vulnerability.
Learn more here
Authentication Bypass Vulnerability in N-able N-central Exploited in the Wild
CVE-2026-18577 is a critical authentication bypass vulnerability in N-able N-central that has been actively exploited as a zero-day since at least late July 2026. The vulnerability allows an unauthenticated remote attacker to obtain administrative access to vulnerable N-central servers, potentially providing access to downstream systems managed through the RMM platform.
According to Wiz data, less than 1% of cloud environments have resources vulnerable to this vulnerability.
Critical SSRF Vulnerability in MLflow Exploited in-the-Wild
A critical unauthenticated server-side request forgery (SSRF) vulnerability in MLflow, tracked as CVE-2026-64849 (CVSS 9.3), allows remote attackers to force vulnerable MLflow Tracking Servers to access internal services and return their responses. The flaw could expose sensitive information including cloud metadata and credentials. Researchers have reported observing exploitation attempts against cloud-hosted MLflow instances shortly after the CVE was assigned.
According to Wiz data, 23% of cloud environments have resources vulnerable to this vulnerability.
Learn more here
XSS2Shell: WordPress Vulnerability Chain Allows RCE
CVE-2026-64638, dubbed XSS2Shell, is a vulnerability chain in WordPress Core that can allow an unauthenticated attacker to achieve cross-site scripting (XSS) and potentially escalate to remote code execution (RCE). While exploitation does not require the attacker to authenticate, the demonstrated RCE chain requires user interaction from a logged-in administrator, specifically visiting an attacker-controlled page that initiates the exploit flow.
According to Wiz data, less than 1% of cloud environments have resources vulnerable to this vulnerability.
Learn more here
🔓Security incidents & campaigns
Payroll Pirates Phishing Campaign Targets Microsoft 365 Financial Workflows
Researchers identified an active adversary-in-the-middle (AiTM) phishing campaign targeting Microsoft 365 users across multiple industries. The campaign uses voicemail-themed phishing emails to bypass multi-factor authentication (MFA), compromise Microsoft 365 accounts, and automate the collection of finance-related email while maintaining long-lived access through rotating residential proxy infrastructure.
Learn more here
arrayref and Other Rust Crates Hijacked in Supply Chain Attack
On August 20, 2026, malicious versions of three Rust crates were published to crates.io from the account of their maintainer: arrayref, internment and append-only-vec. The malicious arrayref added a typosquatted dependency (proc-macro1) whose build script downloads and executes a remote binary. Because build scripts run during compilation, building an affected project was sufficient to execute the payload. The Rust Security Response Team deleted the malicious versions and locked the account, and assesses that the maintainer's machine or credentials were compromised.
Learn more in our blog
Hold on to your headphones!
Tune in to "Crying Out Cloud", our monthly roundup of cloud security news podcast! Hosted by the talented duo Eden Naftali and Amitai Cohen 👏
Listen on Spotify and Apple Podcasts.