KEV Lag Tracker → CVE-2026-72898. Data verified against the official CISA KEV catalog and the National Vulnerability Database.

CISA added CVE-2026-72898 (Metabase) to the Known Exploited Vulnerabilities catalog on August 11, 2026. It was publicly known for 1 day before CISA confirmed active exploitation. A KEV listing is CISA’s official confirmation that a vulnerability is being exploited in the wild.

The Record

CVECVE-2026-72898
Vendor / productMetabase
VulnerabilityMetabase SQL Injection Vulnerability
CVSS base score10
NVD publication dateAugust 10, 2026
Added to CISA KEVAugust 11, 2026
Lag (public → KEV listing)1 days
Federal patch deadlineAugust 14, 2026
Known ransomware useNo

Measured against the 1675 entries in our tracker with verified publication dates, CVE-2026-72898 was flagged faster than 84% of them.

What CISA Reported

CISA describes the flaw as follows: “Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.”

Federal Patch Deadline

Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-72898 by August 14, 2026 — a 3-day remediation window from the KEV listing date. Private organizations are not bound by that deadline; CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.

What EPSS Forecast Before the Confirmation

EPSS had no score for CVE-2026-72898 on the day before CISA confirmed exploitation. That normally means the CVE had not yet been published when it was already being exploited — a case no forecast could have flagged. Its current EPSS probability is 79.22%. See the EPSS accuracy analysis for how often this happens.

How This Compares

We do not yet track enough Metabase entries to publish a vendor median (the threshold is five with verified publication dates), so the reference here is the catalog as a whole:

Across all tracked KEV entriesValue
Entries with verified publication dates1675
Median lag (disclosure → KEV listing)265 days
Exploited within 7 days of disclosure24%
Tied to known ransomware campaigns20%

Defense guide: How to Detect SQL Injection: Attack Chain & Defense (2026) — detection signals, attack chain and response steps for this class of attack.

Frequently Asked Questions

What is CVE-2026-72898?

CVE-2026-72898 is a vulnerability in Metabase (Metabase SQL Injection Vulnerability) that CISA added to its Known Exploited Vulnerabilities catalog on August 11, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild.

How long was CVE-2026-72898 public before CISA confirmed exploitation?

1 calendar days, measured from its NVD publication date to the date CISA added it to the KEV catalog.

What is the federal patch deadline for CVE-2026-72898?

U.S. federal agencies must remediate CVE-2026-72898 by August 14, 2026, a 3-day window from the KEV listing date. Private organizations are not bound by that deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.

Is CVE-2026-72898 used in ransomware campaigns?

CISA has not flagged CVE-2026-72898 as known to be used in ransomware campaigns. That field reflects confirmed campaign use, not the absence of risk.

Is a 1-day lag typical?

The median across all 1675 KEV entries we track with verified publication dates is 265 days, so CVE-2026-72898 is below the catalog median.

Related Coverage

Primary Sources

How We Track This

This page is generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No date or figure on this page is estimated or taken from a third-party source — they come directly from CISA and NVD records. Free to cite with attribution to CVEDaily (CC BY 4.0).