CISA ADDS ACTIVELY EXPLOITED CISCO, MICROSOFT AND METABASE VULNERABILITIES TO KEV CATALOG

THREAT SUMMARY

Category: Active Exploitation / Network Security / Operating-System Security / SQL Injection
Affected Products: Cisco Secure Firewall Adaptive Security Appliance, Cisco Secure Firewall Threat Defense, Microsoft Windows, Metabase
CVEs: CVE-2026-20349, CVE-2026-68820, CVE-2026-72898
Primary Risks: Firewall Compromise, Security-Control Disruption, Memory Corruption, Privilege Abuse, Unauthorized Code Execution, Database Access, Data Exposure, Configuration Manipulation, Service Interruption, Persistent Access
Threat Status: Confirmed Active Exploitation
Affected Environments: Federal Agencies, Enterprise Networks, Critical Infrastructure, Publicly Exposed Systems, Windows Endpoints, Windows Servers, Business-Intelligence Platforms, Data-Analytics Environments
Attack Vectors: Heap Inspection, Use-After-Free, SQL Injection
CISA Action: Added Three Vulnerabilities to the Known Exploited Vulnerabilities Catalog
Required Response: Apply Vendor Remediation, Prioritize High-Risk Exposed Assets and Assess Systems for Evidence of Exploitation

---

The Cybersecurity and Infrastructure Security Agency has added three vulnerabilities affecting Cisco security appliances, Microsoft Windows and the Metabase business-intelligence platform to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation.

CISA announced the additions on August 11, 2026. The newly listed vulnerabilities are CVE-2026-20349, affecting Cisco Secure Firewall Adaptive Security Appliance and Firewall Threat Defense; CVE-2026-68820, affecting the Microsoft Windows Ancillary Function Driver for WinSock; and CVE-2026-72898, affecting Metabase.

The three vulnerabilities expose different layers of an organization’s technology environment. Cisco ASA and FTD systems can operate at critical network boundaries, the Windows Ancillary Function Driver supports network communications inside the operating system, and Metabase provides access to organizational databases and analytical information.

Successful exploitation could affect perimeter defenses, endpoint or server security, and protected data. The final impact depends on the affected product, vulnerable version, system configuration, attacker access and privileges available through the compromised component.

CISA has not identified the threat actors exploiting the vulnerabilities, named affected organizations, disclosed the number of known compromises or connected the activity to a single campaign.

The agency has also not stated whether the exploitation is associated with ransomware, espionage, data theft, financial activity or destructive operations. Inclusion in the KEV Catalog confirms that malicious exploitation is occurring, but it does not establish that every vulnerable deployment has been compromised.

Organizations should prioritize remediation based on exposure, business importance, system privileges and the amount of protected information accessible through each affected product.

---

Vulnerability Details

CVE-2026-20349 — Cisco Secure Firewall ASA and FTD

Vulnerability: Heap Inspection Vulnerability
Affected Products: Cisco Secure Firewall Adaptive Security Appliance and Cisco Secure Firewall Threat Defense

CVE-2026-20349 is a heap inspection vulnerability affecting Cisco Secure Firewall ASA and FTD.

Cisco ASA and FTD products are commonly positioned at network boundaries and may perform firewall enforcement, traffic inspection, remote-access control and threat-detection functions. A vulnerability affecting those systems can create risks beyond the appliance itself because the products may control access between public networks, internal resources and administrative environments.

Heap-related vulnerabilities involve improper handling of dynamically allocated memory. Depending on the vulnerable function and exploitation conditions, memory corruption may cause a process to terminate, security services to become unavailable or attacker-controlled instructions to affect system operation.

CISA’s alert does not identify the affected software versions, exposed service, required authentication level, observed exploitation sequence or indicators of compromise.

The alert also does not state whether exploitation results in code execution, denial of service, information disclosure or another technical outcome. Organizations must use current Cisco guidance to determine the exact affected versions, remediation requirements and conditions under which exploitation can occur.

Security teams should treat exposed management interfaces and externally reachable services as priority assets. A firewall should not be considered protected solely because it serves as a security device. Compromise of a perimeter appliance may affect traffic visibility, access enforcement, remote connectivity and trust relationships with connected systems.

---

CVE-2026-68820 — Microsoft Windows Ancillary Function Driver for WinSock

Vulnerability: Use-After-Free
Affected Product: Microsoft Windows
Affected Component: Ancillary Function Driver for WinSock

CVE-2026-68820 is a use-after-free vulnerability affecting the Windows Ancillary Function Driver for WinSock.

The Ancillary Function Driver supports communications between Windows applications and the operating system’s networking functions. Because the component operates within the Windows environment, exploitation may affect endpoints and servers using vulnerable versions of the operating system.

A use-after-free condition occurs when software continues using memory after that memory has been released. An attacker may attempt to manipulate the freed memory so that the affected process accesses attacker-controlled data or performs unintended actions.

The resulting impact depends on how the vulnerable component handles the memory, the privileges under which it operates and the access required to trigger the flaw. Use-after-free vulnerabilities can produce memory corruption, application failure, system instability, unauthorized code execution or privilege abuse when exploitation conditions permit.

CISA has not publicly described the exploitation method, required access, affected Windows versions, observed payloads or post-exploitation activity associated with CVE-2026-68820.

Organizations must identify vulnerable Windows endpoints and servers, compare installed security updates with current Microsoft remediation guidance and determine whether high-value systems remained exposed before corrective action was applied.

Systems used for administration, identity management, remote access, security monitoring and sensitive data processing should receive priority because compromise of a privileged Windows system can provide access to additional accounts and network resources.

---

CVE-2026-72898 — Metabase

Vulnerability: SQL Injection
Affected Product: Metabase

CVE-2026-72898 is a SQL-injection vulnerability affecting Metabase.

Metabase is used to query, analyze and display information from connected databases. Deployments may contain dashboards, saved queries, user accounts, database credentials and connections to sensitive organizational information.

SQL injection occurs when an application fails to separate untrusted input from instructions sent to a database. An attacker may be able to alter a database query so that the application performs actions outside its intended operation.

The impact depends on the vulnerable function, authentication requirements, database permissions and information accessible through the affected Metabase deployment. Successful exploitation may expose records, bypass application restrictions, alter stored information or interfere with database availability.

A compromised analytics platform may also reveal database structures, internal business information, customer records, operational data or credentials used to connect Metabase to underlying systems.

CISA’s alert does not identify the affected versions, vulnerable endpoint, required privileges, exploitation sequence or indicators of compromise for CVE-2026-72898.

Organizations should identify all Metabase deployments, review their exposure and determine which databases each system can access. Publicly accessible instances and deployments connected to regulated, financial, customer or operational data require immediate attention.

---

Operational Impact

• Compromise of Cisco ASA or FTD security appliances
• Disruption of firewall and traffic-inspection functions
• Loss of visibility into network activity
• Unauthorized changes to security configurations
• Exposure of remote-access services
• Interruption of network connectivity
• Memory corruption within vulnerable Windows systems
• Unauthorized code execution when exploitation conditions permit
• Privilege abuse on Windows endpoints or servers
• System instability or application failure
• Access to administrative credentials or authentication material
• Compromise of Metabase applications
• Unauthorized database queries
• Exposure of business, customer or operational information
• Modification or deletion of stored data
• Theft of database credentials
• Movement into connected applications or databases
• Establishment of persistent access
• Reduced effectiveness of security monitoring
• Business and operational disruption

---

The scope of any compromise will depend on the affected system’s role, configuration, network exposure and available privileges.

Cisco appliances positioned between public and internal networks may require a broader assessment than isolated systems because they can control traffic and trusted access paths. Vulnerable Windows systems with administrative privileges may expose credentials and connected resources. Metabase deployments linked to sensitive databases may require examination of both the application and every data source accessible through it.

Remediation must address the vulnerability and the possibility that exploitation occurred before an update or mitigation was applied.

---

Federal Response

CISA added CVE-2026-20349, CVE-2026-68820 and CVE-2026-72898 to the Known Exploited Vulnerabilities Catalog under Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk.

BOD 26-04 establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies and reinforces the KEV Catalog’s role in identifying vulnerabilities requiring prioritized federal action.

The directive requires agencies to prioritize rapid remediation of high-risk KEV vulnerabilities affecting publicly exposed assets when exploitation can provide total control of the affected system.

BOD 26-04 uses a risk-based framework that allows agencies to direct immediate attention toward assets presenting the greatest operational danger while deferring lower-risk work according to the directive’s requirements.

The directive also establishes expectations for determining whether threat actors compromised a system before remediation was completed.

That examination matters because installing an update does not remove unauthorized accounts, stolen credentials, altered security settings, malicious files or persistence established before the vulnerability was corrected.

Federal agencies must identify affected Cisco, Microsoft and Metabase assets, evaluate their exposure and business importance, apply required remediation and determine whether historical activity requires a compromise assessment.

BOD 26-04 applies directly to Federal Civilian Executive Branch agencies. CISA encourages private companies, critical-infrastructure operators, state and local governments and other organizations to adopt risk-based vulnerability management and prioritize KEV-listed vulnerabilities.

---

Known Exploited Vulnerabilities Catalog

CISA adds a vulnerability to the KEV Catalog when it has a Common Vulnerabilities and Exposures identifier, reliable evidence of active exploitation and clear remediation guidance.

The addition of the three vulnerabilities confirms that CISA determined each one satisfies the requirements for catalog inclusion.

The KEV designation is more significant than a vulnerability rating alone because it confirms that attackers have moved beyond theoretical risk and are exploiting the flaw against real systems.

A catalog addition does not disclose the scale of exploitation or establish that every affected system faces the same degree of risk. It does provide organizations with a verified basis for moving the vulnerability ahead of flaws that have not been observed in active attacks.

Government agencies, software providers, security researchers and cybersecurity professionals may nominate additional vulnerabilities for review. A nomination must include a CVE identifier, evidence of exploitation and actionable mitigation guidance.

---

Defensive Guidance

• Identify every Cisco ASA and FTD deployment.
• Identify all Windows endpoints and servers running affected versions.
• Locate every Metabase deployment, including testing and development systems.
• Compare installed versions with current vendor security guidance.
• Apply available security updates and required mitigations.
• Prioritize publicly exposed and externally reachable systems.
• Restrict firewall management interfaces to trusted administrative networks.
• Remove unnecessary public access to security appliances and Metabase services.
• Require strong authentication for administrative accounts.
• Review remote-access configurations and authorized users.
• Preserve system, network, authentication and application records before remediation.
• Examine Cisco appliances for unauthorized configuration changes.
• Review firewall rules, administrator accounts and remote-access activity.
• Investigate unexplained service interruptions or security-process failures.
• Review Windows systems for unexpected privilege changes and process activity.
• Examine authentication records for unfamiliar administrative sessions.
• Search for unauthorized tools, scripts, services and scheduled tasks.
• Audit Metabase accounts, permissions, saved queries and database connections.
• Review database logs for unexpected queries or large data retrieval activity.
• Determine whether Metabase connection credentials were exposed.
• Rotate credentials, tokens and keys suspected of compromise.
• Inspect connected databases for unauthorized changes.
• Review outbound network activity from affected systems.
• Isolate systems when immediate remediation cannot be completed.
• Conduct a compromise assessment when exposure or suspicious activity warrants it.
• Confirm remediation across production, testing, backup and recovery environments.
• Continue monitoring corrected systems for signs of persistent access.
• Preserve relevant evidence for forensic analysis.

Organizations should define separate investigation plans for each affected technology. Firewall review should focus on configurations, remote access and traffic control. Windows examination should focus on privilege activity, processes and persistence. Metabase review should include the application, its accounts and the databases connected to it.

---

30-Day Outlook

• Accelerated scanning for exposed Cisco ASA, FTD and Metabase systems
• Increased exploitation attempts against systems that remain unremediated
• Expanded patching across federal and enterprise environments
• Greater review of Windows systems for evidence of privilege abuse
• Increased examination of firewall configurations and remote-access activity
• Additional analysis of exploitation methods and affected versions
• Possible publication of indicators of compromise
• Increased credential rotation for affected applications and appliances
• Broader database-access reviews involving Metabase deployments
• Continued KEV additions as CISA confirms exploitation of other vulnerabilities

---

TRJ Verdict

CVE-2026-20349, CVE-2026-68820 and CVE-2026-72898 must be treated as active operational threats because CISA has confirmed exploitation and added all three vulnerabilities to the Known Exploited Vulnerabilities Catalog.

The affected products occupy different but critical positions inside modern environments. Cisco ASA and FTD protect network boundaries, the Windows Ancillary Function Driver supports operating-system networking, and Metabase connects users to organizational databases.

A compromise at any of these layers may extend beyond the initially affected product. Firewall exploitation may weaken security enforcement, Windows exploitation may expose privileged access, and SQL injection may provide a route to sensitive records or connected database resources.

Applying vendor remediation is necessary, but patching cannot determine whether an attacker already gained access. Security teams must combine updates with historical review, configuration inspection, credential auditing and examination for persistence.

CISA has not disclosed the actors, affected organizations, campaign objectives or full exploitation pathways. The confirmed active-exploitation status establishes that delayed remediation creates a direct and avoidable security risk.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---