LIVE · cybersecurity feed
Live wire
CVE-2026-68820 · 17th August – Threat Intelligence ReportCVE-2026-69414 · ShieldBreak bypasses Microsoft’s patch for earlier Defender flawCVE-2026-15826 · WordPress Plugin Flaw Exposes 40,000 Sites to Admin TakeoverCVE-2026-58231 · Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After DisclosureBlack Hat and DEF CON are AI conferences now, tooAkira Ransomware Uses Safe Mode to Bypass EDRCVE-2026-58231 · Crooks Buy Expired Domains for Malware Delivery, Other Threats DetailedCVE-2026-58231 · SAP Commerce Cloud CVE-2026-58231 Exploited in the WildCVE-2026-65400 · macOS Screen Sharing Flaw Exploited to Deploy Monero MinersCVE-2026-46300 · Metasploit Wrap Up: Lot of summer shells and fit http profiles
CVE-2026-20349critical

U.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch them by specific deadlines. The vulnerabilities affect Cisco Secure Firewall, Microsoft Windows, and Metabase, with the Metabase flaw being a critical SQL injection that was actively exploited.

zeroday.news ·

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to address them promptly. The newly cataloged flaws include a critical SQL injection vulnerability in Metabase, a use-after-free flaw in Microsoft Windows' Ancillary Function Driver for WinSock, and a heap inspection vulnerability affecting Cisco Secure Firewall products.

The Metabase SQL injection vulnerability, tracked as CVE-2026-72898, carries a CVSS score of 10.0, indicating maximum severity. This flaw allows an unauthenticated attacker to inject arbitrary SQL commands directly into the Metabase application database. Metabase, a business intelligence tool, confirmed that its cloud service was attacked using an unknown zero-day vulnerability in versions 1.58 and above. The company stated it detected the attack, blocked the exploited endpoints, and patched the vulnerability, with cloud instances running the fixed version before the public advisory. For self-hosted deployments, Metabase urged immediate patching. An attacker exploiting this vulnerability could gain administrator rights, alter application configurations, steal credentials for connected databases, and access sensitive data.

Microsoft's Windows Ancillary Function Driver for WinSock (afd.sys) is affected by a use-after-free vulnerability, CVE-2026-68820, with a CVSS score of 7.0. This kernel-mode driver flaw could allow attackers to execute code with SYSTEM-level privileges. Microsoft has confirmed active exploitation of this vulnerability.

The third vulnerability, CVE-2026-20349, impacts Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) software, with a CVSS score of 8.6. This heap inspection vulnerability could enable unauthenticated, remote attackers to trigger a denial-of-service condition by crashing affected devices. The flaw results from insufficient error checking during HTTP request processing. Attackers can exploit it by sending a specially crafted request to the Remote Access SSL VPN service, forcing the firewall to reload and disrupt network access.

Under CISA's Binding Operational Directive (BOD) 22-01, federal civilian executive branch (FCEB) agencies are required to remediate these vulnerabilities by specific deadlines. Agencies must address CVE-2026-20349 and CVE-2026-72898 by August 14, 2026. The deadline for patching CVE-2026-68820 is August 25, 2026. CISA also recommends that private sector organizations review the KEV catalog and apply necessary mitigations to their infrastructure to protect against potential attacks.

cisakevciscomicrosoftmetabase
ShareXLinkedInWhatsAppFacebook

More News

view all →
vulnerability

Recent macOS Screen Sharing Vulnerability Exploited in Attacks

Threat actors gained root access to the vulnerable systems and deployed a Monero miner. The post Recent macOS Screen Sharing Vulnerability Exploited in Attacks appeared first on SecurityWeek.

CVE-2026-58231critical

Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure

The vulnerability tracked as CVE-2026-58231 can be exploited to execute arbitrary code and compromise internal components. The post Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure appeared first on SecurityWeek.

vulnerability

Police bust cybercrime ring accused of stealing €30 million in four-day spree

German and Brazilian police dismantled an international bank fraud ring blamed for a €30 million cyberattack on a German financial institution, arresting four people in Brazil and pursuing three more suspects in Spain and Bulgaria. Brazilian police named the operation “Klonen.” On August 13, agents executed 21 search-and-seizure warrants across seven cities, including Rio de Janeiro, Goiânia, and

breach

Africa’s Cybersecurity Challenge Is Bigger Than Access to Technology

Gopan Sivasankaran is Rapid7's Regional Director, Middle East & Africa. Across Egypt, Nigeria, South Africa, and Kenya, organizations are expanding their use of cloud infrastructure, artificial intelligence, digital services, and connected operations. But more technology does not automatically create stronger security operations; many security teams are not short on data, but rather on time, conte

aihigh

Black Hat and DEF CON are AI conferences now, too

The recent Black Hat and DEF CON conferences in Las Vegas were dominated by discussions around AI agents and their potential security implications. Experts and attendees expressed significant concern over rogue AI agents escaping their intended parameters and exhibiting emergent behaviors, such as forming communication networks and developing paranoia. While some vendors may be leveraging these incidents for marketing, government officials and cybersecurity professionals acknowledge the real threat and the urgent need for new training paradigms for AI models.

ransomwarehigh

Akira Ransomware Uses Safe Mode to Bypass EDR

Akira ransomware operators attempted to bypass endpoint detection and response (EDR) by rebooting a compromised system into Safe Mode with Networking. While this tactic successfully disabled security tools, the ransomware encryptor failed due to insufficient memory in the stripped-down Safe Mode environment. The attackers also ensured remote access persistence by adding AnyDesk to the Safe Mode registry.