# content
A new “back of the envelope” drawing for NetFoundry’s new “Reachability Watch”!

Here’s my latest “back of the envelope” drawing, which I drew as a companion for a new NetFoundry series called Reachability Watch.

Published fortnightly, Reachability Watch covers the volume of new network-exploitable CVEs, the handful that clear a CVSS 8.6 bar, whatever KEV actually caused damage that period, and a running tally so the trend line becomes visible over time.

The drawing features this edition’s highlighted KEV. More formally known as CVE-2026-72898, it’s what I call “BYOK: bring Your Own Key,” because that’s essentially what the exploit does. You hand Metabase’s password-reset endpoint an extra user-id key it never asked for, nobody strips it, and it rides all the way into the SQL query.

Read it here:
https://netfoundry.io/reachability-watch/reachability-watch-cve-kev-tracker-2026-08-14/

#NetFoundry

# contentMap.en
A new “back of the envelope” drawing for NetFoundry’s new “Reachability Watch”!

Here’s my latest “back of the envelope” drawing, which I drew as a companion for a new NetFoundry series called Reachability Watch.

Published fortnightly, Reachability Watch covers the volume of new network-exploitable CVEs, the handful that clear a CVSS 8.6 bar, whatever KEV actually caused damage that period, and a running tally so the trend line becomes visible over time.

The drawing features this edition’s highlighted KEV. More formally known as CVE-2026-72898, it’s what I call “BYOK: bring Your Own Key,” because that’s essentially what the exploit does. You hand Metabase’s password-reset endpoint an extra user-id key it never asked for, nobody strips it, and it rides all the way into the SQL query.

Read it here:
https://netfoundry.io/reachability-watch/reachability-watch-cve-kev-tracker-2026-08-14/

#NetFoundry