The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to address these flaws due to active exploitation. The vulnerabilities affect Metabase, Microsoft Windows, and Cisco Secure Firewall products.
The first vulnerability, CVE-2026-72898, is a critical SQL injection flaw in Metabase, a business intelligence tool, with a CVSS score of 10.0. This vulnerability allows an unauthenticated attacker to inject arbitrary SQL commands directly into the Metabase application database. Metabase confirmed that its cloud instances were attacked using an unknown zero-day vulnerability in versions 1.58 and above. The company stated it detected the attack, blocked the exploited endpoints, and patched the vulnerability, with cloud instances automatically updated. However, self-hosted deployments require immediate action from administrators. Exploitation of this flaw could grant an attacker administrator rights over the Metabase instance, enabling them to alter application configurations, steal stored credentials for connected databases, and exfiltrate sensitive data.
The second vulnerability, CVE-2026-68820, is a use-after-free flaw in the Microsoft Windows Ancillary Function Driver for WinSock (afd.sys), carrying a CVSS score of 7.0. This kernel-mode driver underpins the Windows Sockets API. Exploitation of this vulnerability can allow an attacker to execute code with SYSTEM-level privileges. Microsoft has confirmed active exploitation of this flaw.
The third vulnerability, CVE-2026-20349, affects Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) software. This heap inspection vulnerability has a CVSS score of 8.6 and could allow an unauthenticated, remote attacker to trigger a denial-of-service condition by crashing affected devices. The flaw arises from insufficient error checking when processing HTTP requests. An attacker can exploit it by sending a specially crafted request to the Remote Access SSL VPN service, which forces the firewall to reload and disrupts network access.
Under CISA's Binding Operational Directive (BOD) 22-01, federal civilian executive branch (FCEB) agencies are required to remediate vulnerabilities listed in the KEV catalog by specified due dates. CISA has set a deadline of August 14, 2026, for agencies to fix the Metabase and Cisco Secure Firewall vulnerabilities. The deadline for addressing the Microsoft Windows vulnerability is August 25, 2026. While these directives apply to federal agencies, CISA also recommends that private organizations review the KEV catalog and address these vulnerabilities within their own infrastructure to enhance their security posture against known exploited threats.
