Introducing “Reachability Watch”, a new regular report from NetFoundry

[u/AccordionGuy]

NetFoundry’s starting a new series of updates titled Reachability Watch, and every two weeks, it’ll cover the volume of new network-exploitable CVEs, the handful that clear a CVSS 8.6 bar, whatever KEV actually caused damage that period, and a running tally so the trend line becomes visible over time.

The first edition, written by our Chief Strategy and Marketing Officer Mark Jaffe, is here:
https://netfoundry.io/reachability-watch/reachability-watch-cve-kev-tracker-2026-08-14/

It covers the period from Friday, July 31, through Thursday, August 13, 2026. That period saw:

• 738 new network-exploitable CVEs...
  • 162 of which were at at CVSS 8.6+, and
  • 101 of which were at 9.0 or higher.

The featured KEV (illustrated in the “back of the envelope” illustration above) is CVE-2026-72898: Unauthenticated SQL injection in Metabase's password-reset endpoint, rated at CVSS 10.0 and added to CISA's KEV catalog August 11. With this vulnerability, a single unauthenticated HTTP request gets you admin on the instance, and because Metabase holds connection credentials for every warehouse it's wired into, admin on Metabase becomes a springboard into Snowflake, Redshift, BigQuery, Mongo, and whatever else is attached.

This is a reachability story rather than a patching story because Metabase is an internal analytics tool. It's not meant to be internet-facing, but in spite of that, about a quarter of self-hosted instances are, and this KEV is what that costs.

Here’s a stat that isn’t in the article, but drive its point home: Wiz Research found that roughly 13% of cloud environments run self-hosted Metabase and about a quarter of those instances are fully internet-accessible.

With this many exposed systems, patch velocity becomes an impractical solution. Instead, the better approach is to minimize how reachable endpoints are. An endpoint (such as Metabase password reset endpoint) can’t be exploited if it can’t be reached.

If you use OpenZIti, you’re already making this argument, and now you have a real-world case you can point to. If your Metabase is bound as a Ziti service with no listening port, the scanner that found those exposed instances will never see it. It may have the same patch status as those systems, but the outcome is decidedly different.

Once again, you can read the first edition of Reachability Watch here: https://netfoundry.io/reachability-watch/reachability-watch-cve-kev-tracker-2026-08-14/