CISA Adds Three Known Exploited Vulnerabilities to Catalog

What Changed

On August 11, CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-20349 in Cisco Secure Firewall ASA and FTD, CVE-2026-68820 in the Windows Ancillary Function Driver for WinSock (AFD.sys), and CVE-2026-72898 in Metabase. Federal civilian agencies must act under BOD 26-04.

Cisco ASA and FTD (CVE-2026-20349)

This CVSS 8.6 flaw lets an unauthenticated remote attacker send a crafted HTTP request to the Remote Access SSL VPN service and force the device to reload, causing denial of service. Devices are affected when IKEv2 remote access with client services, SSL VPN (webvpn) or Zero Trust Network Access is enabled. Cisco says there are no workarounds and that it became aware of exploitation earlier this month. The federal deadline is August 14.

Windows AFD.sys (CVE-2026-68820)

This use-after-free flaw lets a local attacker escalate to SYSTEM. Microsoft marked it as exploited in August Patch Tuesday, and reporting links it to North Korean Lazarus activity against defense organizations. It is a post-compromise tool, so patching should be paired with hunting for existing footholds.

Metabase (CVE-2026-72898)

Metabase rates this unauthenticated SQL injection in /api/session/reset_password as critical (CVSS 10.0) and has confirmed exploitation. It can give an attacker administrator access to the instance, stored credentials for connected databases and the data behind them. Patched releases are x.58.24, x.59.21, x.60.17, x.61.11, x.62.9 and x.63.5 for each supported major version. If you cannot upgrade, block the reset-password endpoint.

What To Verify First

• Patch ASA and FTD devices that have remote-access VPN features enabled.
• Deploy the August Windows updates, starting with privileged and high-value workstations.
• Upgrade Metabase, then revoke all sessions, review API keys and admins, and rotate connected database credentials if the endpoint was exposed.

Source Context

This item was rebuilt from the following primary sources and original reporting:

• CISA: CISA Adds Three Known Exploited Vulnerabilities to Catalog (August 11, 2026)
• The Hacker News: Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS
• Metabase security advisory GHSA-vwf4-m7j8-wcjf
• BleepingComputer: Lazarus hackers exploited Windows zero-day to target defense firms

Related In The Daily Brief

See this item in The 5-Minute Cyber Brief

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].

Keep Reading

Explore more →

Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access

Attackers are actively exploiting CVE-2026-59310, a CVSS 9.8 directory-traversal flaw in VMware vCenter, and incident responders are seeing successful compromise…

#StopRansomware: Gunra Ransomware

A joint FBI, CISA and partner advisory warns about Gunra, a Conti-derived ransomware-as-a-service that exploits internet-facing devices, deletes backups and…

GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address

Arctic Wolf's GoCaracal research is useful because it adds specifics to the Dark Caracal story: a Go-based framework with lightweight…