The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to address them promptly. The newly cataloged flaws include a critical SQL injection vulnerability in Metabase, a use-after-free flaw in Microsoft Windows' Ancillary Function Driver for WinSock, and a heap inspection vulnerability affecting Cisco Secure Firewall products.
The Metabase SQL injection vulnerability, tracked as CVE-2026-72898, carries a CVSS score of 10.0, indicating maximum severity. This flaw allows an unauthenticated attacker to inject arbitrary SQL commands directly into the Metabase application database. Metabase, a business intelligence tool, confirmed that its cloud service was attacked using an unknown zero-day vulnerability in versions 1.58 and above. The company stated it detected the attack, blocked the exploited endpoints, and patched the vulnerability, with cloud instances running the fixed version before the public advisory. For self-hosted deployments, Metabase urged immediate patching. An attacker exploiting this vulnerability could gain administrator rights, alter application configurations, steal credentials for connected databases, and access sensitive data.
Microsoft's Windows Ancillary Function Driver for WinSock (afd.sys) is affected by a use-after-free vulnerability, CVE-2026-68820, with a CVSS score of 7.0. This kernel-mode driver flaw could allow attackers to execute code with SYSTEM-level privileges. Microsoft has confirmed active exploitation of this vulnerability.
The third vulnerability, CVE-2026-20349, impacts Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) software, with a CVSS score of 8.6. This heap inspection vulnerability could enable unauthenticated, remote attackers to trigger a denial-of-service condition by crashing affected devices. The flaw results from insufficient error checking during HTTP request processing. Attackers can exploit it by sending a specially crafted request to the Remote Access SSL VPN service, forcing the firewall to reload and disrupt network access.
Under CISA's Binding Operational Directive (BOD) 22-01, federal civilian executive branch (FCEB) agencies are required to remediate these vulnerabilities by specific deadlines. Agencies must address CVE-2026-20349 and CVE-2026-72898 by August 14, 2026. The deadline for patching CVE-2026-68820 is August 25, 2026. CISA also recommends that private sector organizations review the KEV catalog and apply necessary mitigations to their infrastructure to protect against potential attacks.
