TLP:GREEN  ·  States / Public Sector
Kemp LoadMaster, a Metabase Zero-Day, and Nation-State Pre-Positioning Converge:

Critical Vulnerabilities Under Active Exploitation Demand Immediate Action from State Government IT Leaders

ELEVATED. Unchanged from the prior cycle. A CVSS 9.6 pre-authentication RCE in Progress Kemp LoadMaster is confirmed under active exploitation and listed in CISA's KEV catalog, a zero-day in the Metabase BI platform has been exploited in the wild to breach a technology company, ICS/SCADA advisories affect ABB Ability Zenon and Johnson Controls TL280, and Qilin ransomware continues claiming three victims per day — a pace that historically precedes government-sector targeting.

I am a
My sector

DateEventSignificance
25 July 2026Salt Typhoon and Volt Typhoon persistent access disclosed in U.S. state and National Guard networksChinese MSS-affiliated actors confirmed pre-positioned in state government infrastructure
1 August 2026MuddyWater (Iranian MOIS) confirmed actively targeting water/wastewater PLCs across 7+ U.S. statesOngoing ICS/OT campaign against critical water infrastructure; expanding footprint
6 August 2026CISA publishes ICS advisories for ABB Ability Zenon (ICSA-26-218-01) and Johnson Controls TL280 (ICSA-26-218-02)Both products deployed in state water treatment and building automation systems
7 August 2026CVE-2026-8037 added to CISA KEV; 792 documented exploitation attemptsPre-auth RCE in Kemp LoadMaster; federal remediation deadline 10 August
8 August 2026N-able confirms full managed endpoint compromise via CVE-2026-18577 exploitation with Cloudflare Tunnel persistenceMSP supply chain vector — state agencies using N-able N-central at risk
9 August 2026Qilin ransomware claims 3 new victims in 24 hours (manufacturing, energy, retail)Sustained operational tempo; government targeting historically follows by 2–4 weeks
10 August 2026Metabase zero-day confirmed exploited in the wild (Framework breach)Unauthenticated admin takeover; state agencies running Metabase face mass PII exposure

TimeframeThreat CategoryKey Actors/VulnerabilitiesRisk to State Government
Active NOWEdge device exploitationCVE-2026-8037 (Kemp LoadMaster, CVSS 9.6)CRITICAL — Pre-auth RCE, active exploitation confirmed
Active NOWSaaS/BI platform compromiseMetabase zero-day (unauthenticated admin takeover)HIGH — Connected to citizen databases in many agencies
Active NOWMSP supply chainCVE-2026-18577 (N-able N-central, CVSS 8.1)HIGH — Full endpoint compromise via managed services
OngoingRansomware-as-a-ServiceQilin (S1242), Cactus, INC RansomwareHIGH — 146% YoY increase; gov targeting imminent
PersistentNation-state pre-positioningVolt Typhoon, Salt Typhoon (Chinese MSS)HIGH — Confirmed in state/National Guard networks
PersistentCritical infrastructure targetingMuddyWater (Iranian MOIS)ELEVATED — Active against water/wastewater PLCs in 7+ states
EmergingICS/OT vulnerabilitiesABB Ability Zenon, Johnson Controls TL280ELEVATED — Advisories issued; no active exploitation yet

This is the highest-priority vulnerability for state IT this week. An OS command injection flaw in Kemp LoadMaster API endpoints allows unauthenticated attackers to achieve remote code execution via unsanitized input. With 792 documented exploitation attempts and CISA KEV listing, this is not a matter of "if" but "who has already been compromised."

CVSS: 9.6 CRITICAL. Exploitation: Active, confirmed by CISA, Watchtowr Labs, and eSentire. Patch: Available since June 2026.

Bottom line: any unpatched Kemp LoadMaster appliance exposed to the internet should be assumed compromised until verified otherwise.

T1190T1059.004

A zero-day vulnerability in Metabase was exploited to breach Framework (a laptop manufacturer), with confirmed data exfiltration. The vulnerability allows unauthenticated remote attackers to gain full administrative access to Metabase instances.

For state government, this is particularly dangerous because Metabase instances are frequently connected directly to backend databases containing citizen PII — tax records, DMV data, health information, and benefits records. A single compromised Metabase instance could expose millions of resident records.

Complicating factor: most state IT organizations lack a centralized inventory of Metabase deployments. Agencies adopt open-source BI tools independently, creating shadow IT exposure that central security teams cannot assess without active discovery.

T1190T1078.003T1530

Volt Typhoon and Salt Typhoon (both Chinese MSS-affiliated) have had no new public reporting for 72+ hours. This is not reassuring. These actors were confirmed pre-positioned in U.S. state and National Guard networks as of July 25, 2026. Their operational doctrine emphasizes long-dwell persistence — months or years of quiet access before activation during a geopolitical crisis.

Additional tracked nation-state actors with state government relevance: VAULT PANDA and GENESIS PANDA (CrowdStrike-tracked, Chinese state-sponsored); STARDUST CHOLLIMA (Lazarus subgroup, North Korean); MuddyWater (Iranian MOIS) — actively targeting water/wastewater PLCs across 7+ U.S. states; ALTERED SPIDER — credential theft operations.

Qilin ransomware's current operational tempo (3 victims per day across manufacturing, energy, and retail) represents a leading indicator for state government. Historical pattern analysis shows ransomware groups exhaust higher-paying private sector targets before pivoting to public sector organizations for media attention and political pressure.

Ransomware operators are now systematically targeting mid-level managers in finance, HR, and operations — exactly the roles that dominate state government agencies. With attempts up 146% year-over-year, the question is when, not if, a state agency is hit.

T1486T1490

Two CISA ICS advisories issued on 6 August directly affect state government infrastructure: ABB Ability Zenon (ICSA-26-218-01) — vulnerabilities that could allow attackers to bypass security, crash systems, and execute unauthorized actions in water treatment SCADA environments; and Johnson Controls TL280 (ICSA-26-218-02) — an information disclosure vulnerability in building automation communicators deployed across state facilities.

Combined with MuddyWater's (Iranian MOIS) ongoing targeting of water/wastewater PLCs, the ICS threat surface for state government is expanding faster than most OT teams can patch.

T0831

ScenarioProbabilityTimeframeBasis
Additional Metabase exploitation reports as attackers scan for unpatched instances70% (HIGH)72 hoursZero-day now public; automated scanning inevitable
Qilin or Cactus claims a U.S. government victim50% (MODERATE)7 days3 victims/day tempo; historical private→public pivot pattern
CVE-2026-8037 exploitation attributed to a specific nation-state actor20% (LOW)14 daysCurrent evidence suggests opportunistic scanning, not targeted
Volt Typhoon/Salt Typhoon activity surfaces in new state networks40% (MODERATE)30 daysConfirmed pre-positioning; discovery is ongoing
MuddyWater expands water/wastewater targeting to additional states45% (MODERATE)30 daysAlready active in 7+ states; expanding footprint

ATT&CK TechniqueWhat to MonitorDetection Approach
T1190 — Exploit Public-Facing ApplicationKemp LoadMaster API endpoints; Metabase login/admin endpointsAlert on anomalous API calls to LoadMaster management interfaces; monitor Metabase access logs for unauthenticated admin session creation
T1059.004 — Unix ShellLoadMaster appliances executing unexpected shell commandsDeploy file integrity monitoring on LoadMaster; alert on new processes spawned by web service accounts
T1078.003 — Valid Accounts (Local)Metabase admin account creation or privilege escalationMonitor Metabase audit logs for new admin accounts; alert on admin actions from unexpected source IPs
T1530 — Data from Cloud Storage ObjectBulk data export from Metabase-connected databasesMonitor database query logs for unusual SELECT * or bulk export patterns from Metabase service accounts
T1486 — Data Encrypted for ImpactVolume shadow copy deletion, mass file encryptionCanary files in shared drives; alert on vssadmin/wmic shadowcopy delete
T1490 — Inhibit System RecoveryBackup deletion, boot configuration changesMonitor backup infrastructure health; alert on bcdedit modifications
T0831 — ICS Manipulation of ControlUnauthorized setpoint changes in ABB ZenonOT network monitoring for unexpected write commands to PLCs
Hunting Hypotheses:
HUNT 01 · T1190
Kemp LoadMaster appliances have been compromised via CVE-2026-8037
Hunt for: unexpected outbound connections from LoadMaster management IPs; new cron jobs or scheduled tasks on LoadMaster OS; web shells in the LoadMaster file system; lateral movement from the LoadMaster network segment.
HUNT 02 · T1078.003
Metabase instances are being enumerated or exploited
Hunt for: internet-facing Metabase instances (Shodan/Censys query for your IP ranges); unusual database query volume from Metabase service accounts; new Metabase admin accounts created in the last 30 days; large data exports from Metabase-connected databases.
HUNT 03
N-able N-central has been leveraged for persistence via Cloudflare Tunnel
Hunt for: Cloudflare Tunnel binaries (cloudflared) on managed endpoints; unexpected outbound connections to Cloudflare infrastructure from endpoints that shouldn't have them; N-able agent executing non-standard scripts.
HUNT 04
Volt Typhoon living-off-the-land persistence exists in state networks
Hunt for: anomalous use of ntdsutil, netsh, wmic, and PowerShell by service accounts; scheduled tasks created by non-standard processes; unusual SMB lateral movement patterns during off-hours.

Financial Services
State Treasury, Revenue, Benefits
Primary threat
Metabase zero-day — treasury and revenue agencies commonly use Metabase for financial reporting dashboards connected to tax and payment databases.
Secondary threat
Qilin specifically targets finance department personnel via credential phishing.
Actions
  • Immediately audit all Metabase instances connected to financial systems; verify no unauthorized admin accounts exist
  • Implement database query rate limiting on Metabase service accounts
  • Enforce hardware MFA for all financial system access
Energy
State Utility Oversight, Public Power
Primary threat
ABB Ability Zenon vulnerabilities (ICSA-26-218-01) in SCADA environments; MuddyWater (Iranian MOIS) targeting of water/wastewater PLCs.
Secondary threat
Volt Typhoon pre-positioning specifically targets energy infrastructure for disruption during geopolitical crisis — assume persistent access exists and hunt accordingly.
Actions
  • Segment OT networks from IT networks with unidirectional gateways where possible
  • Apply ABB patches within 7 days
  • Increase monitoring of PLC communication protocols for unauthorized write commands
Healthcare
State Health Agencies, Medicaid Systems
Primary threat
Metabase connected to health/benefits databases containing PHI; ransomware targeting healthcare for maximum pressure.
Secondary threat
Pre-position an incident response retainer; test failover to paper-based processes for benefits determination.
Actions
  • Inventory all BI tools connected to health data systems
  • Verify HIPAA-compliant access controls on Metabase instances
  • Ensure offline backup capability for Medicaid eligibility systems
Government
Central IT, All Agencies
Primary threat
Kemp LoadMaster (CVE-2026-8037) as the entry point to state data center infrastructure; N-able supply chain compromise for endpoint access.
Secondary threat
Ransomware operators targeting mid-level managers (HR, finance, operations) — deploy targeted phishing simulations for these roles.
Actions
  • Emergency patch verification for all LoadMaster appliances
  • Audit N-able N-central for Cloudflare Tunnel persistence indicators
  • Enforce network segmentation between agency environments
Aviation / Logistics
State DOT, Aviation Authority, Emergency Services
Primary threat
CISA advisory ICSA-26-219-01 identifies clear-text unauthenticated radio links in aviation communication systems (CPDLC/ATN-B1); Johnson Controls TL280 in transportation facilities.
Secondary threat
Verify that logistics management platforms (fleet tracking, dispatch) are not running vulnerable Metabase instances for operational dashboards.
Actions
  • Assess applicability of aviation communication vulnerabilities to state aviation authority systems
  • Patch Johnson Controls TL280 firmware in transportation facilities
  • Review emergency communication system resilience

Verify ALL Kemp LoadMaster appliances are patched to June 2026 firmware addressing CVE-2026-8037 (CVSS 9.6, CISA KEV). Isolate any unpatched instances from internet-facing networks immediately. Assume compromise if unpatched and initiate forensic review.
Incident Responder
Inventory ALL Metabase instances across state agencies. Patch to the latest version addressing the zero-day. Disable public-facing Metabase instances until patched and verified. Audit admin accounts for unauthorized creation.
Incident Responder
Deploy detection rules for CVE-2026-8037 exploitation indicators: anomalous API calls to LoadMaster management interfaces, unexpected shell execution on LoadMaster appliances, lateral movement from LoadMaster network segments.
SOC Analyst
Audit N-able N-central deployments for indicators of CVE-2026-18577 exploitation: Cloudflare Tunnel binaries on managed endpoints, unauthorized script execution via N-able agent.
Incident Responder
No immediate actions for the selected roles.
Review ABB Ability Zenon deployments at water treatment and utility facilities against ICSA-26-218-01. Apply vendor patches or implement compensating controls (network segmentation, enhanced monitoring of PLC communications).
ICS / OT
Assess Johnson Controls TL280 communicator deployments in state buildings. Apply firmware update per ICSA-26-218-02 to prevent information disclosure.
ICS / OT
Implement targeted monitoring for credential theft against mid-level managers in finance, HR, and operations roles — the primary ransomware initial access vector. Deploy conditional access policies requiring compliant devices for sensitive system access.
SOC AnalystIAM Analyst
Conduct a Volt Typhoon living-off-the-land hunt across state networks: anomalous ntdsutil, netsh, wmic, PowerShell usage by service accounts; unexpected scheduled tasks; off-hours SMB lateral movement.
Threat Hunter
No 7-day actions for the selected roles.
Evaluate state exposure to open-source BI/analytics platforms (Metabase, Apache Superset, Redash) connected to production databases. Establish policy requiring WAF/reverse proxy protection and mandatory authentication hardening for all BI tools.
CISO / Exec
Review third-party risk management posture against emerging NIS2/DORA-style regulatory expectations. Begin cross-framework control mapping for state IT vendors.
CISO / Exec
Conduct a tabletop exercise simulating a Qilin ransomware attack against a state agency, including a double-extortion data leak scenario. Validate backup restoration timelines and communication protocols with the Governor's office.
CISO / ExecIncident Responder
Establish a centralized inventory process for all self-hosted open-source tools (Metabase, Gitea, Mattermost, Nextcloud) deployed by individual agencies. Decentralized adoption without central visibility creates unmanageable attack surface.
CISO / Exec
No 30-day actions for the selected roles.
The Bottom Line

The threat environment facing state government IT remains at ELEVATED levels with no indication of near-term reduction. The combination of actively exploited critical vulnerabilities (CVE-2026-8037, the Metabase zero-day), confirmed nation-state pre-positioning (Volt Typhoon, Salt Typhoon in state networks), sustained ransomware tempo (Qilin at 3 victims/day), MuddyWater's ongoing targeting of water/wastewater PLCs, and expanding ICS/OT attack surface (ABB Zenon, Johnson Controls) creates a multi-vector threat environment that requires coordinated defensive action. The silence from nation-state actors is not comfort — it is their operational design. The absence of a government ransomware victim today is a countdown, not a reprieve.

1
Approve emergency patch windows for Kemp LoadMaster and Metabase instances this week.
2
Direct agency liaisons to report all open-source BI tool deployments within 72 hours.
3
Every day of delay on CVE-2026-8037 is a day an attacker has pre-auth RCE on your load balancers. Act now.
No items found.