September 4 Security Briefing: French Hospital Fine, ArubaOS-CX, and Metabase

Three distinct risk paths in one day

This briefing covers three separate security priorities: accountability for protecting personal data, unauthenticated code execution in network infrastructure, and incident response for a publicly exposed analytics service. France’s data protection authority, CNIL, fined Hôpital Privé de la Loire €500,000 after investigating a patient-record system breach and weak safeguards. HPE published fixes for ArubaOS-CX, led by CVE-2026-73749, which can allow an unauthenticated remote attacker to execute code with elevated privileges. In Korea, KISA issued an urgent update advisory for Metabase and cited attacks and resulting harm involving three flaws.

Each item requires more than installing a patch. The hospital case turns on remote access, account scope, monitoring delays, and notification coverage. ArubaOS-CX requires branch-specific upgrades plus checks of the switch management plane. Metabase operators need to update the application and then review sessions, API keys, administrator accounts, connected database credentials, and logs.

French hospital breach and €500,000 fine

CNIL announced the sanction on September 3, 2026. The underlying attack occurred in summer 2025 and involved the hospital’s electronic patient-record system. The regulator counted 524,867 patients and 202,246 people designated as trusted contacts, for a total of 727,113 affected individuals.

The decision focused on several layers of security. External users could reach the system without a VPN or multi-factor authentication. A single account could access records across the entire patient population instead of being limited by role and operational need. Monitoring was not sufficiently close to real time, allowing the intruder to browse and exfiltrate data over several days before detection.

Notification scope also mattered. The hospital notified patients but not the 202,246 designated contacts whose data was involved. Healthcare systems frequently hold information about caregivers, family members, and emergency contacts in addition to the primary patient. Incident teams should identify each affected population and map notice obligations to the data actually exposed, rather than treating the account holder as the only relevant person.

For operators, the practical review has three parts. Enforce VPN or an equivalent protected path and MFA for external and third-party accounts. Restrict patient-record access by clinical, administrative, and support roles, and require separate approval and audit records for broad access. Connect bulk viewing, unusual search times, and rapid file export to detection rules. CNIL recognized safeguards already added by the hospital while ordering the remaining work to be completed within periods ranging from three to fifteen months.

ArubaOS-CX and CVE-2026-73749

The highest-severity flaw in HPE’s bulletin, CVE-2026-73749, involves buffer-overflow conditions in an ArubaOS-CX daemon that mishandles malformed input. An unauthenticated remote attacker can send crafted packets to the affected service and potentially run code with elevated privileges. HPE scores the issue 9.8 under CVSS v3.1.

The fixed path depends on the deployed branch. Version 10.18.0001 moves to 10.18.1002 or later; 10.17.1021 and earlier move to 10.17.1030 or later; 10.16.1051 and earlier move to 10.16.1060 or later; 10.13.1180 and earlier move to 10.13.1190 or later; and 10.10.1180 and earlier move to 10.10.1181 or later. HPE notes that 10.10.1181 is already at end of maintenance, so organizations on that branch should combine the immediate fix with a migration plan to a supported release.

The same bulletin covers additional management-module, web-interface, API, adjacent-network, and factory-default credential weaknesses. An efficient response inventories every AOS-CX asset and its management path instead of searching for one CVE on one switch. Teams should identify management interfaces reachable from the internet or user VLANs, certificate-authenticated sessions and APIs exposed beyond the management network, and devices still using initial credentials after deployment or zero-touch provisioning.

The operational sequence is inventory, containment, upgrade, and validation. Record the model, software branch, stack or VSX role, and management IP for each switch. Restrict management access to a dedicated network and approved administrative hosts. Confirm configuration backup and recovery procedures before deploying the fixed release in the correct high-availability order. After reboot, validate management login, routing adjacencies, VLANs, ACLs, link aggregation, and monitoring. Review administrator sessions and configuration history for unexpected accounts, API calls, or privilege changes.

KISA’s urgent Metabase advisory

KISA’s September 3 advisory identifies CVE-2026-72898, CVE-2026-72899, and CVE-2026-72900. The first two are SQL injection flaws and the third is a missing-authorization issue. A public card or dashboard with a field-filter parameter can be abused to inject SQL into the Metabase application database. Administrative access can then expose application settings, stored credentials for connected databases, and data available through those connections.

The affected maintenance lines span Metabase x.58 through x.63. The minimum fixed releases are x.63.5, x.62.9, x.61.11, x.60.17, x.59.21, and x.58.24. Operators need to compare the complete point release, not just the major or minor line. Metabase Cloud customers receive the patched release through the service, while self-hosted deployments require direct action by their operators.

Incident-response checks should follow the upgrade. If `/api/session/reset_password` is publicly reachable, revoke all active sessions, review API keys and administrator-account changes, rotate connected database credentials, and inspect data-warehouse and Metabase activity and query logs. The vendor’s indicator pattern is a `POST /api/session/reset_password` request returning 400 followed by `GET /api/user/current` returning 200. Searching both application and ingress logs for that sequence helps distinguish routine scanning from a path that may have reached the application.

When an immediate upgrade is impossible, operators can temporarily block `/api/session/reset_password`. This is a short-term containment measure, not a replacement for the fixed release. Review public dashboard UUID exposure, reverse-proxy path rules, and administrator API policy, then confirm that temporary blocking does not continue to break legitimate password recovery after the application has been upgraded.

Today’s order of work

All three items involve management functions placed at a system boundary: external patient-record access, the switch management plane, and public dashboards plus a password-reset API. Exposure, excessive privilege, and delayed detection can amplify damage even though the underlying products and sectors differ.

Prioritize by real exposure. Locate internet-reachable self-hosted Metabase instances and ArubaOS-CX management interfaces first. Apply the supported fixed release while preserving session, credential, and configuration-change evidence. For healthcare and customer-data systems, review per-account record scope and bulk-access detection separately. Finally, confirm with privacy and legal teams that the notification population matches every group whose information was involved.

The versions and actions in this briefing reflect the official information available on September 3, 2026. Compare the vendor tables and release notes against the deployed model, licensing, high-availability design, and support status before making changes.