What Changed
On August 11, CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-20349 in Cisco Secure Firewall ASA and FTD, CVE-2026-68820 in the Windows Ancillary Function Driver for WinSock (AFD.sys), and CVE-2026-72898 in Metabase. Federal civilian agencies must act under BOD 26-04.
Cisco ASA and FTD (CVE-2026-20349)
This CVSS 8.6 flaw lets an unauthenticated remote attacker send a crafted HTTP request to the Remote Access SSL VPN service and force the device to reload, causing denial of service. Devices are affected when IKEv2 remote access with client services, SSL VPN (webvpn) or Zero Trust Network Access is enabled. Cisco says there are no workarounds and that it became aware of exploitation earlier this month. The federal deadline is August 14.
Windows AFD.sys (CVE-2026-68820)
This use-after-free flaw lets a local attacker escalate to SYSTEM. Microsoft marked it as exploited in August Patch Tuesday, and reporting links it to North Korean Lazarus activity against defense organizations. It is a post-compromise tool, so patching should be paired with hunting for existing footholds.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Metabase (CVE-2026-72898)
Metabase rates this unauthenticated SQL injection in /api/session/reset_password as critical (CVSS 10.0) and has confirmed exploitation. It can give an attacker administrator access to the instance, stored credentials for connected databases and the data behind them. Patched releases are x.58.24, x.59.21, x.60.17, x.61.11, x.62.9 and x.63.5 for each supported major version. If you cannot upgrade, block the reset-password endpoint.
What To Verify First
- Patch ASA and FTD devices that have remote-access VPN features enabled.
- Deploy the August Windows updates, starting with privileged and high-value workstations.
- Upgrade Metabase, then revoke all sessions, review API keys and admins, and rotate connected database credentials if the endpoint was exposed.
Source Context
This item was rebuilt from the following primary sources and original reporting:
- CISA: CISA Adds Three Known Exploited Vulnerabilities to Catalog (August 11, 2026)
- The Hacker News: Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS
- Metabase security advisory GHSA-vwf4-m7j8-wcjf
- BleepingComputer: Lazarus hackers exploited Windows zero-day to target defense firms
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Thursday’s brief: Cisco email gateways under attack, then PAN-OS, Nextcloud and AhsayCBS
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
