CVE-2026-72898

CVSS

—

EPSS

0.190 (97.2th percentile)

CISA KEV

Added 2026-08-11, due 2026-08-14

Exploitation

No report

Public exploits

9 repositories

State

Unknown

Coverage

• ● Actively exploitedCritical 85JPCERT14 Aug, 04:30

  注意喚起: MetabaseのSQLインジェクションの脆弱性（CVE-2026-72898）に関する注意喚起 (公開)

  ↗jpcert.or.jp/at/2026/at260023.html(opens the publisher's site in a new tab)
• 

  ● Actively exploitedCritical 85Wiz Research10 Aug, 12:30

  Inside the Metabase SQLi: Exploited in the Wild

  Reverse engineering Metabase CVE-2026-72898 with AI to accelerate defense.

  ↗wiz.io/blog/inside-the-metabase-sqli-exploited-…(opens the publisher's site in a new tab)

What we observed

1. 24 Sept, 12:28poc publishedpoc-in-github
2. 24 Sept, 12:14poc publishedpoc-in-github
3. 24 Sept, 11:51poc publishedpoc-in-github
4. 24 Sept, 11:50kev addedcisa-kev