CISA added three actively exploited flaws to its KEV catalog on August 11, and each one lands with a different team. One hits Cisco ASA/FTD edge devices. Another is the Windows AFD.sys privilege-escalation bug, now publicly tied to exploitation. The third is a Metabase SQL injection that can expose the credentials and data an analytics server holds.
A KEV listing means attackers are already using the flaw. The work now is deciding which systems and teams move first.
Cisco ASA/FTD, Windows afd.sys and Metabase
CISA added these three CVEs to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation:
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
- CVE-2026-20349: Cisco Secure Firewall ASA and Firewall Threat Defense heap-inspection vulnerability.
- CVE-2026-68820: Microsoft Windows Ancillary Function Driver for WinSock use-after-free vulnerability in
afd.sys. - CVE-2026-72898: Metabase SQL injection vulnerability.
Each needs different handling. The Cisco bug sits on edge devices. The Windows bug is a privilege escalation that attackers use after they are already in, and the damage from the Metabase bug depends on what data the server can reach.
Where each bug does damage
Once a CVE is in KEV, there is no point arguing over whether it is only severe on paper. What matters is whether you still expose it and how fast you can close it.
Cisco ASA/FTD often sits at the network edge and handles remote access. CVE-2026-68820 helps an attacker who already runs code on a Windows host get to SYSTEM. Metabase servers often hold stored database credentials and connections to data sources well beyond the app itself.
A starting order: edge, then Metabase, then Windows
A reasonable order to start with:
- First: Cisco ASA/FTD (
CVE-2026-20349) if you run affected internet-facing or business-critical remote-access infrastructure. Edge devices usually go first because a delay there exposes more. - Next: Metabase (
CVE-2026-72898) if you use self-hosted or broadly accessible analytics environments. The bigger risk is what the server can reach through its stored credentials and connected databases. - Also urgent: Windows AFD.sys (
CVE-2026-68820) on Windows hosts where you suspect a foothold or are containing an incident. Attackers use this kind of bug after initial access to reachSYSTEM.
Your own environment may change that order.
Three CVEs, three owners
Patching is often the quick part. Finding who owns each system takes longer.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
The delay usually comes from basic questions nobody can answer quickly. Do we run the affected product? Is it exposed? Who owns it? What else can it touch if exploited? Did anyone use it before the patch landed?
Here the Cisco firewalls probably belong to the network team and Metabase to a data or product team, while the AFD.sys fix falls to endpoint or infrastructure staff. Get them on one schedule quickly, or the fixes drift into the normal backlog.
Name owners, check exposure, send a status note
- Inventory whether you run affected Cisco ASA/FTD, Metabase, or Windows systems where
CVE-2026-68820matters, and give each one a named owner today. - Prioritize internet-facing Cisco ASA/FTD and any externally reachable or widely used Metabase deployments ahead of normal patch backlog work.
- For Metabase, treat this as a possible credential and data exposure as well as a patch. Check what connected databases, saved credentials, or administrative functions the platform can reach.
- For Windows AFD.sys, review whether there are recent signs of suspicious local execution, privilege-escalation attempts, or incident activity on high-value Windows systems where an attacker might chain the flaw after initial access.
- Check whether the affected assets were already exposed before patching, because CISA's current directive language also expects you to look for compromise from before the fix landed.
- Push a short stakeholder update that says which of the three CVEs you are exposed to, what is being patched first, and where there is still risk.
- Keep watching the primary source pages for revised scope, remediation guidance, or due-date expectations, especially if your internal teams need stronger justification for an emergency change window.
Sources
Source: CISA alert, August 11, 2026, which names CVE-2026-20349, CVE-2026-68820, and CVE-2026-72898.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
