A CVSS 10 unauthenticated RCE in Progress LoadMaster hit CISA KEV this weekend with confirmed in-the-wild exploitation — 30,000+ enterprise networks run these load balancers. Meanwhile, Iranian threat actors demonstrated a technique most defenders have never modeled: pivoting through private APN cellular infrastructure to sabotage a Polish energy facility. And the Iran-linked campaign against US water utilities expanded to at least a dozen states. Today’s brief covers the three stories that will drive customer conversations this week, plus a Metabase zero-day that hit before the patch landed.

In the News

Progress LoadMaster CVSS 10 RCE Added to CISA KEV

CISA added a critical unauthenticated remote command injection vulnerability in Progress Kemp LoadMaster to its Known Exploited Vulnerabilities catalog. The flaw scores a perfect CVSS 10 — unauthenticated, remote, and leading to full command execution on the underlying operating system.

LoadMaster is a hardware and virtual application delivery controller deployed in over 30,000 enterprise networks for load balancing, SSL offloading, and application routing. The management interface is the attack surface. Any instance with the management plane exposed to the internet is trivially exploitable — no credentials, no interaction, no complexity.

Federal agencies now face mandatory remediation deadlines under BOD 22-01. The practical concern extends well beyond federal networks: LoadMaster sits inline between users and production applications. An attacker with command execution on the load balancer controls traffic flow, can intercept credentials in transit, and has a privileged position for lateral movement into backend infrastructure.

What defenders should do: Patch immediately. If a patch is not yet deployed, restrict management interface access to a dedicated out-of-band management VLAN. Audit firewall rules to confirm no LoadMaster management ports (typically TCP/443 or TCP/8443 on the management interface) are exposed to the internet. Review access logs for any unauthenticated API calls or command execution patterns.

Iranian Threat Actors Pivot Through Private APN to Sabotage Polish Energy

CERT.PL confirmed the first documented use of private APN infrastructure as an attack vector in an ICS intrusion. Iranian-linked threat actors exploited the private cellular network segmentation that a Polish energy facility used for SCADA backhaul — bypassing the traditional IT/OT network boundary entirely.

This is a significant technique evolution. Private APNs are cellular network segments that utilities and critical infrastructure operators lease from mobile carriers specifically to isolate operational technology communications. The assumption is that these segments are not routable from the public internet and are invisible to attackers operating within the enterprise IT network. That assumption failed. The attackers found a path through the carrier layer — a segment that most ICS security architectures do not include in their network diagrams, threat models, or monitoring coverage.

This is the second Polish energy facility sabotaged by the same actor group. The first attack used more conventional IT/OT pivot techniques. The shift to private APN targeting suggests the actors adapted after the first facility hardened its wired OT segmentation.

What defenders should do: If your organization uses private LTE or 5G for SCADA, telemetry, or any OT backhaul, extend your segmentation model and monitoring to include that cellular path. Treat the private APN as another network zone subject to the same firewall policy, traffic baselining, and anomaly detection as wired OT segments. Engage your mobile carrier to audit APN routing tables and access controls.

Iran-Linked ICS Attacks Hit Water Utilities in 12+ US States

The campaign targeting US water utility industrial control systems has expanded to at least a dozen states, with New Jersey and Alabama newly confirmed. Attackers are exploiting internet-exposed ICS interfaces — primarily Unitronics PLCs with default credentials — and weak or absent multi-factor authentication on remote access pathways.

CISA has issued sector-specific alerts and is conducting on-site assessments at affected utilities. The political and operational pressure is accelerating procurement cycles: state and local governments that previously deprioritized OT security are now issuing emergency RFPs for segmentation, remote access hardening, and ICS monitoring.

The attack methodology is not sophisticated — default credentials and internet-exposed management interfaces are the entry point. The scale is what makes this consequential. Water treatment directly impacts public health, and most small and mid-sized utilities lack dedicated security staff or OT-aware monitoring infrastructure.

What defenders should do: Audit all ICS and SCADA interfaces for internet exposure. Change all default credentials on PLCs and HMIs. Deploy phishing-resistant MFA on every remote access path into OT environments. Segment ICS networks from corporate IT with enforced firewall policy — not just VLANs.

Metabase Zero-Day Exploited — Unauthenticated Admin Takeover

An unauthenticated admin takeover vulnerability in Metabase, the open-source business intelligence platform used by over 50,000 organizations, was exploited as a zero-day before a patch was available. The flaw carries a CVSS 9.8 score. Attackers gained full administrative control without credentials, enabling data exfiltration, query manipulation, and lateral movement through database connections configured within Metabase.

Metabase is frequently embedded deep in analytics stacks, often connecting to production databases with elevated privileges. A compromised Metabase instance is not just a BI tool loss — it is a direct path to every data source the platform queries.

What defenders should do: Update Metabase immediately. Audit admin accounts for unauthorized creation or privilege escalation. Review database connection credentials configured in Metabase and rotate them. Check query logs for unusual data exports during the pre-patch exposure window.

Defender Action Items

  • LoadMaster: Patch or isolate management interfaces to out-of-band management VLANs. Confirm no management ports are internet-exposed via external scan.
  • Private APN / OT: If using private LTE/5G for SCADA backhaul, add cellular segments to network diagrams, threat models, and monitoring. Audit APN routing with your carrier.
  • Water utilities / ICS: Audit for internet-exposed PLC/HMI interfaces. Change default credentials. Deploy phishing-resistant MFA on all OT remote access.
  • Metabase: Patch immediately. Rotate all database connection credentials configured in the platform. Audit admin account creation logs.
  • Developer tooling: Review installed VS Code extensions against a known-good list — the malicious “Solidity Pro” extension stole crypto wallets and API keys from developers. Lock down IDE extension sources in enterprise environments.

Detection Queries

LoadMaster management interface exploitation attempts can be detected by monitoring for unauthenticated API requests to the management plane. If you forward LoadMaster access logs to your SIEM, the following Splunk SPL query identifies suspicious unauthenticated command execution patterns:

index=loadbalancer sourcetype="kemp:loadmaster:access"
| where NOT match(user, "^(admin|api-service|monitor)$")
| where http_method="POST" AND (uri_path="*/access/set*" OR uri_path="*/access/exec*")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip uri_path http_status
| where count > 3
| sort -count

This surfaces POST requests to LoadMaster management API endpoints from unauthenticated sessions or unexpected source IPs. Tune the user exclusion list to match your legitimate service accounts. False positive rate is low if management interfaces are properly restricted — any hit from an unexpected source IP warrants immediate investigation.

For ICS/SCADA exposure detection, query for Unitronics PLC traffic patterns on your perimeter:

index=firewall action=allowed dest_port=20256
| stats count by src_ip dest_ip
| where NOT cidrmatch("10.0.0.0/8", src_ip) AND NOT cidrmatch("172.16.0.0/12", src_ip) AND NOT cidrmatch("192.168.0.0/16", src_ip)
| sort -count

Port 20256 is the default Unitronics PCOM protocol port. Any allowed external traffic to this port is a critical finding — Unitronics PLCs should never be directly internet-accessible.

References

Subscribe to the it-learn Brief

Get the daily cybersecurity brief in your inbox every weekday morning — news, SE angles, and detection queries.