Verified status as of August 8, 2026
Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.
- CVE-2026-8037 in Progress LoadMaster is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-08-07; federal remediation due 2026-08-10). NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a patch reference.
TL;DR
Atlassian Rovo AI can be tricked to send Jira/Confluence data to attackers; Progress LoadMaster CVE-2026-8037 added to CISA KEV with 792 exploitation attempts; Metabase zero-day SQLi actively exploited to steal customer data. No patches available for all three. Immediate investigation and network segmentation required.
Executive Summary
- Atlassian Rovo AI assistant contains a prompt-injection flaw allowing attackers to exfiltrate Jira and Confluence data accessible to signed-in users; two independent attack routes identified, one confirmed closed.
- Progress LoadMaster CVE-2026-8037 (command injection RCE) added to CISA KEV on August 7 with 792 reported exploitation attempts; federal remediation deadline August 10.
- Metabase zero-day SQL injection (CVSS 10.0, no CVE assigned) exploited in the wild to breach customer instances including Framework and Tally; no patch available.
- CSS-based webmail attacks affect Outlook, Gmail, Yahoo, Fastmail, Proton, and AOL Mail, enabling password and token theft via content-escape techniques.
- TrueConf video conference servers compromised by Head Mare group to deliver trojanized client installers with backdoors.
Top Threats Today
1. Atlassian Rovo Prompt Injection – Data Exfiltration
Severity: HIGH Affected: Technology
Atlassian’s Rovo AI assistant can be manipulated via attacker-controlled instructions to collect and transmit Jira or Confluence data that a signed-in user can access to an external server [1]. Two independent security researchers discovered the vulnerability via different attack paths; however, only one of those routes is confirmed to be closed ⚠[1][2]. The flaw does not require user authentication beyond having a logged-in session, making it a significant risk in environments where Rovo is active across user workstations.
Sources:[1] The Hacker News[2] SecurityWeek
Recommended Action
- Audit Rovo usage across your environment; disable Rovo if not operationally required until a full patch is released
- Monitor Jira and Confluence access logs for anomalous data export or API calls, particularly those targeting sensitive projects or pages
- Apply Atlassian’s guidance when available; verify that both documented attack routes are blocked
- Restrict Rovo permissions to minimum necessary scopes via Atlassian access control policies
2. Progress LoadMaster CVE-2026-8037 – Command Injection RCE
Severity: HIGH Affected: Technology
Progress LoadMaster contains a command injection vulnerability (CVE-2026-8037) that allows an unauthenticated attacker to execute arbitrary commands on the appliance by exploiting unsanitized input in multiple command endpoints [1][2]. CISA added this critical-severity flaw to its Known Exploited Vulnerabilities catalog on August 7, 2026, following reports of 792 active exploitation attempts in the wild [1]. The federal remediation deadline is August 10, 2026 [2]. LoadMaster is widely used in enterprise load-balancing and reverse-proxy deployments; unpatched instances are at immediate risk of full compromise. ⚠
Sources:[1] The Hacker News[2] CISA KEV
Recommended Action
- Identify all LoadMaster instances in your environment and verify their current version
- Apply Progress’s security patches immediately; prioritize systems facing untrusted networks
- Check LoadMaster access logs for suspicious command execution patterns or unusual API calls (especially to command endpoints)
- Segment LoadMaster from critical systems; restrict network access to trusted administrative interfaces only
- Monitor for indicators of compromise including unexpected process execution or outbound connections
3. Metabase Zero-Day SQL Injection – Unauthenticated Admin Access
Severity: HIGH Affected: Technology
A critical Metabase SQL injection vulnerability (rated CVSS 10.0, no CVE assigned) has been actively exploited in the wild to grant unauthenticated remote attackers ⚠ admin-level access [1][2]. The vulnerability does not require authentication and has been used in documented breaches of Framework and Tally customer instances ⚠[2]. No patch has been released; Metabase has issued a warning but remediation details remain limited.
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Check Metabase instance logs for unusual SQL queries, failed login attempts, or admin account creation events
- Isolate affected Metabase instances from the broader network until a vendor patch is available
- If possible, restrict Metabase network access to internal IP ranges and VPN only
- Monitor vendor advisories closely for patch availability and apply immediately upon release
- Consider temporary access controls or credentials rotation for any Metabase admin or service accounts
4. CSS-Based Webmail Attacks – Password and Token Theft
Severity: HIGH Affected: Technology
New research demonstrates CSS-based attack techniques that allow content embedded in email messages to escape its message boundary and interfere with the webmail interface itself [1]. Attack chains identified across Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail enable attackers to capture user passwords, take over third-party accounts, and leak authentication tokens [1]. These attacks exploit fundamental CSS rendering logic in webmail clients and require no user action beyond opening a malicious email.
Sources:[1] The Hacker News
Recommended Action
- Educate users not to enter passwords or sensitive data within webmail interfaces if the session appears unusual or if email UI elements render unexpectedly
- Enable multi-factor authentication (MFA) on all email accounts to reduce the impact of password theft
- Monitor email gateway logs for abnormal formatting or script injection attempts in inbound messages
- Work with your webmail provider to verify that CSS sandboxing and content isolation controls are enabled
5. TrueConf Backdoor Trojanization – Client Installer Compromise
Severity: HIGH Affected: Technology
The Head Mare hacktivist group has exploited vulnerabilities in unpatched TrueConf video conferencing servers to replace legitimate client installers with trojanized versions containing backdoors [1]. This supply-chain-adjacent attack vector affects organizations that download and distribute TrueConf clients from compromised server instances, potentially leading to widespread client-side compromise across multiple users.
Sources:[1] BleepingComputer
Recommended Action
- If using TrueConf, audit all downloaded client installers against file hashes provided by the vendor
- Patch TrueConf server instances immediately to prevent installer replacement
- Re-distribute TrueConf clients from trusted sources (official vendor downloads or verified internal repositories) and verify installation integrity on endpoints
- Scan deployed TrueConf clients for unexpected processes or network connections
Today’s Action Checklist
- ☐ URGENT (by Aug 10): Identify and patch all Progress LoadMaster instances; federal deadline is August 10, 2026
- ☐ URGENT: Audit Metabase access logs for unauthorized admin account creation or SQL injection patterns; isolate unpatched instances
- ☐ TODAY: Disable or restrict Atlassian Rovo usage until both documented attack routes are confirmed patched
- ☐ TODAY: Enable MFA on all email accounts and brief users on CSS webmail attacks; monitor webmail gateways for suspicious formatting
- ☐ TODAY: If using TrueConf, patch servers and audit/re-distribute client installers from trusted sources