Listen to this Post
A New Warning From CISA
Cybersecurity defenders are facing another urgent patching window as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The affected technologies span three very different layers of modern infrastructure: network security appliances, the Windows kernel, and a business intelligence platform connected to sensitive corporate databases.
Why This Alert Matters
These vulnerabilities are particularly concerning because they are not simply theoretical security weaknesses. Their appearance in the KEV catalog indicates that they have been associated with real-world exploitation and deserve immediate attention from organizations operating affected systems.
The three flaws are CVE-2026-20349, affecting Cisco Secure Firewall ASA and FTD; CVE-2026-68820, affecting the Windows Winsock kernel driver; and CVE-2026-72898, a critical SQL injection vulnerability in Metabase.
Three Different Attack Paths
At first glance, these vulnerabilities appear unrelated. One can crash a firewall, another can potentially provide SYSTEM-level control over Windows, while the third can open a path into databases through a business intelligence application.
But together, they illustrate a broader cybersecurity problem: attackers do not need to compromise the same technology everywhere. They only need to find the weakest exposed door.
CVE-2026-20349: Cisco Firewalls Under Attack
CVE-2026-20349 affects Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software.
The vulnerability can allow an unauthenticated remote attacker to cause affected devices to crash and enter a denial-of-service condition.
How the Cisco Flaw Works
The problem is associated with insufficient error checking while the software processes HTTP requests.
An attacker can send a specially crafted HTTP request to the Remote Access SSL VPN service. If successfully processed, the malicious request can force the firewall to reload.
That means an attacker does not necessarily need valid credentials to disrupt the device.
Why a Firewall Crash Is Serious
A firewall is supposed to be one of the most important defensive layers inside an enterprise network.
If an attacker can repeatedly force a firewall to reload, the consequences can extend beyond a temporary inconvenience. Remote employees may lose VPN access, network services can become unavailable, and security teams may be forced into emergency recovery procedures.
The Bigger Cisco Risk
The most dangerous scenario is repeated exploitation.
A single crash may create downtime. Repeated requests can potentially turn the weakness into a persistent availability attack, especially if administrators have not applied the appropriate security update or mitigation.
For organizations heavily dependent on remote access, the impact can be especially disruptive.
CVE-2026-68820: A Windows Kernel-Level Threat
The second vulnerability is CVE-2026-68820, a use-after-free vulnerability in afd.sys.
The file is associated with the Windows kernel-mode driver supporting the Windows Sockets API, commonly known as Winsock.
Why Kernel Vulnerabilities Are Different
A vulnerability in a kernel component deserves special attention because the kernel operates at one of the highest privilege levels in Windows.
According to the supplied advisory information, exploitation of CVE-2026-68820 can allow attackers to execute code with SYSTEM-level privileges.
That is a dramatically different scenario from simply crashing an application.
SYSTEM-Level Execution
SYSTEM is among the highest privileged security contexts available to Windows processes.
If an attacker can reliably turn a vulnerability into code execution at that level, the compromised machine could potentially become a platform for credential theft, persistence, lateral movement, security-tool interference, or deployment of additional malware.
Microsoft Says Exploitation Is Happening
Microsoft has indicated that CVE-2026-68820 is being actively exploited.
Interestingly, the supplied information notes that its CVSS assessment lists exploit maturity as “Unproven.”
That apparent contradiction is important.
CVSS exploit-maturity scoring and real-world exploitation reporting measure different things. A vulnerability can have limited public exploit maturity while still being observed in attacks.
Why Defenders Should Not Wait
Organizations sometimes prioritize vulnerabilities according to severity scores alone.
That can be dangerous.
A vulnerability with a moderate or uncertain-looking score can become far more important when there is evidence that attackers are already using it.
CISA’s KEV designation provides exactly that additional context.
CVE-2026-72898: The Metabase SQL Injection Crisis
The third vulnerability may be the most alarming from a data-security perspective.
CVE-2026-72898 is a SQL injection vulnerability affecting Metabase.
From SQL Injection to Database Access
SQL injection vulnerabilities allow attackers to manipulate database queries by supplying malicious input that the application fails to handle safely.
In this case, the vulnerability can allow an unauthenticated attacker to inject arbitrary SQL directly into the Metabase application database.
That removes one of the most important defensive barriers: authentication.
Metabase’s Position Makes the Risk Worse
Metabase is not merely an isolated web application.
Business intelligence platforms are commonly connected to databases containing sales records, customer information, financial information, operational data, analytics, and other valuable corporate datasets.
Compromising the analytics layer can therefore provide attackers with a pathway toward information that the organization considers highly sensitive.
The Cloud Attack
According to the supplied Metabase advisory, the company discovered that Metabase Cloud had been attacked through an unknown zero-day vulnerability affecting versions 1.58 and above.
Metabase says it blocked the endpoints involved in the attack, identified the vulnerability, and patched it.
The Potential Blast Radius
The SQL injection vulnerability represents much more than the ability to execute an unwanted database query.
The supplied advisory describes a possible escalation path in which an attacker could obtain administrator privileges over the Metabase instance, modify application configuration, access stored credentials for connected databases, query data accessible through those connections, and potentially extract information.
That is an extremely serious attack chain for a business intelligence platform.
Cloud Customers Had an Advantage
Metabase Cloud customers were in a better position because the provider handled the emergency response.
The company detected the attack, blocked the abused endpoint, and deployed the fixed version.
This illustrates one of the strongest arguments for managed cloud services: security patches can sometimes be deployed centrally and quickly.
Self-Hosted Metabase Is Different
Organizations running Metabase themselves cannot assume they received the same protection automatically.
Self-hosted installations require administrators to identify vulnerable versions, obtain the appropriate security update, deploy it, restart services where necessary, and verify that the vulnerable component is no longer exposed.
For affected self-hosted environments, this should be treated as an emergency security task rather than an ordinary maintenance update.
Why CISA Added These Vulnerabilities to KEV
CISA’s Known Exploited Vulnerabilities catalog is designed to help organizations prioritize vulnerabilities that attackers are actually exploiting.
That distinction matters.
There are thousands of disclosed vulnerabilities every year. Security teams cannot realistically treat every vulnerability with exactly the same urgency.
KEV Changes the Priority
When a vulnerability enters the KEV catalog, defenders have a stronger reason to move it toward the front of the remediation queue.
For federal civilian executive branch agencies covered by the relevant requirements, these vulnerabilities come with mandatory remediation deadlines.
The Federal Deadlines
According to the supplied advisory, federal agencies must address CVE-2026-20349 and CVE-2026-72898 by August 14, 2026.
CVE-2026-68820 has a later deadline of August 25, 2026.
With August 14 approaching, organizations should not interpret the deadline as a recommended date to begin patching. The safest approach is to begin remediation immediately.
What Organizations Should Do Now
1. Identify Cisco Exposure
Security teams should inventory Cisco Secure Firewall ASA and FTD deployments and determine whether affected versions are present.
Pay particular attention to systems exposing Remote Access SSL VPN services.
2. Audit Windows Systems
Organizations should identify Windows machines affected by CVE-2026-68820 and prioritize systems that are internet-facing, remotely accessible, highly privileged, or frequently used by administrators.
3. Find Metabase Installations
Search both cloud-connected environments and internal infrastructure for Metabase installations.
Do not assume that an old development server is harmless. Internal analytics systems can still contain credentials and connections to valuable databases.
4. Patch Self-Hosted Metabase
If an organization operates Metabase independently, administrators should immediately verify the installed version and apply the vendor’s security fix.
Patching should be followed by validation that the vulnerable endpoint is no longer exploitable.
5. Investigate for Indicators of Compromise
Patching is not enough when exploitation has already been reported.
Security teams should review authentication logs, web requests, application logs, firewall events, endpoint telemetry, database activity, and administrator-account changes.
6. Rotate Exposed Credentials
If there is evidence that a vulnerable Metabase instance was compromised, organizations should consider credentials potentially exposed through the application as compromised.
That may include database passwords, service credentials, API keys, and other secrets accessible to the application.
7. Monitor Network Traffic
Unexpected outbound connections from Metabase servers, Windows endpoints, or firewall infrastructure should receive additional scrutiny.
Attackers often need a second stage after exploiting the initial vulnerability.
Deep Analysis: How Defenders Can Investigate the Threat
Check Windows for the Vulnerable Driver
Administrators can begin by identifying the Windows version and inspecting the relevant driver:
Get-Item "$env:windir\System32\driversfd.sys" | Select-Object FullName, Length, LastWriteTime
This does not determine vulnerability by itself, but it can help establish what driver is installed before comparing the system against Microsoft’s applicable security update information.
Inspect Recent System Events
Security teams can review recent system events for unexpected crashes or unusual driver behavior:
Get-WinEvent -FilterHashtable @{
LogName='System'
StartTime=(Get-Date).AddDays(-7)
} | Where-Object {
$_.Message -match 'afd.sys|network|socket'
} | Select-Object TimeCreated, Id, ProviderName, Message
Unexpected clusters of networking-related crashes deserve investigation.
Search for Suspicious Web Requests
For internet-facing services, administrators should review HTTP logs for unusual requests and repeated malformed traffic.
A basic Linux search might look like:
grep -Ei 'POST|GET|PUT|DELETE' /var/log/nginx/access.log | tail -n 500
The exact log location will depend on the deployment.
Investigate Metabase Logs
For a self-hosted Metabase deployment, administrators should examine application logs around the time suspicious activity occurred:
grep -Ei 'error|exception|sql|query|admin|authentication' metabase.log
This is not an exploit detector by itself. It is a starting point for correlating suspicious application behavior.
Search for Unexpected Database Activity
Database administrators should review query logs for unusual queries originating from the Metabase application account.
Look for unexpected administrative operations, unusual access patterns, new users, privilege changes, or queries that fall outside normal analytics activity.
Check for Configuration Changes
Because successful compromise could potentially allow an attacker to manipulate application configuration, compare the current configuration against known-good baselines.
Unexpected changes can be more valuable evidence than a single suspicious HTTP request.
Review Administrator Accounts
Inspect Metabase administrator accounts and Windows privileged accounts for unexpected additions or changes:
Get-LocalUser | Select-Object Name, Enabled, LastLogon
On Linux systems:
getent passwd
Account creation alone does not prove compromise, but unexplained privileged accounts should trigger investigation.
Look for Persistence
After an initial compromise, attackers may attempt to establish persistence.
Security teams should inspect scheduled tasks, services, startup locations, cron jobs, SSH keys, and other persistence mechanisms.
For Windows:
Get-ScheduledTask | Select-Object TaskName, TaskPath, State
For Linux:
crontab -l systemctl list-unit-files --state=enabled
Correlate Everything
The most important step is correlation.
A suspicious Metabase request by itself may not prove compromise.
A suspicious request followed by administrator changes, unusual database queries, and unexpected outbound traffic tells a very different story.
That is where SIEM and EDR platforms become particularly valuable.
What Undercode Say: The Real Danger Is the Attack Chain
Three Vulnerabilities, Three Layers
What makes this CISA update particularly interesting is the diversity of the affected technologies.
Cisco protects the network perimeter.
Windows operates inside millions of endpoints and servers.
Metabase sits much closer to corporate data.
Attackers Think in Chains
Modern attackers rarely care about a vulnerability in isolation.
They care about what the vulnerability allows them to reach next.
A firewall denial-of-service flaw can disrupt access.
A kernel vulnerability can potentially establish deep control over an endpoint.
A Metabase vulnerability can provide a bridge toward databases.
Availability Is Also Security
Organizations sometimes treat denial-of-service vulnerabilities as less important than code execution flaws.
That can be a mistake.
A corporate VPN that repeatedly crashes can prevent employees from working and potentially disrupt security operations.
The VPN Is a Valuable Target
Remote access infrastructure is particularly sensitive.
When a firewall terminates VPN connections, any instability can affect employees, administrators, contractors, and third-party access simultaneously.
Kernel Exploitation Raises the Stakes
CVE-2026-68820 deserves especially close attention because kernel-level vulnerabilities can dramatically increase attacker privileges.
The difference between controlling an application and controlling the operating system is enormous.
Metabase Represents a Different Kind of Risk
Metabase demonstrates another modern security reality.
The most valuable target is not always the server itself.
Sometimes the real prize is what the server can access.
Credentials Can Become the Bridge
If an application stores credentials for connected databases, compromising that application can potentially turn those credentials into stepping stones toward sensitive information.
This is why secret management matters so much.
Data Platforms Are Becoming Prime Targets
Business intelligence systems have become increasingly important inside modern companies.
They connect dashboards to production databases, data warehouses, cloud services, customer platforms, and financial systems.
That concentration of access makes them attractive targets.
Zero-Day Attacks Change the Equation
The Metabase incident is particularly significant because the company described the exploited vulnerability as an unknown zero-day at the time of the attack.
Zero-days are difficult to defend against because organizations may have no patch available when exploitation begins.
Detection Becomes Critical
When prevention fails, detection must take over.
Organizations need visibility into unusual requests, authentication events, configuration changes, database activity, and outbound connections.
Patching Is Only Half the Job
If exploitation has already occurred, installing a patch does not magically remove the attacker.
Incident response must determine whether credentials were stolen, accounts were modified, data was accessed, or persistence was established.
Asset Inventory Remains Fundamental
You cannot patch what you do not know exists.
Shadow IT, forgotten servers, old VPN gateways, and abandoned analytics environments remain common sources of risk.
Internet Exposure Makes Everything Worse
A vulnerable application sitting behind multiple layers of access control has a different risk profile from the same application exposed directly to the internet.
Organizations should continuously map their attack surface.
CISA’s KEV List Is a Prioritization Tool
The KEV catalog should not be treated as just another vulnerability feed.
It provides defenders with a practical signal that certain flaws deserve immediate attention.
Security Teams Need Context
CVSS is useful, but it should not be the only decision-making mechanism.
Exploitability, internet exposure, asset criticality, attacker activity, privileges, and business impact should all influence prioritization.
“Unproven” Does Not Mean “Safe”
The CVE-2026-68820 example is a good reminder that exploit maturity labels should not override credible exploitation intelligence.
A vulnerability can have an uncertain public exploit score while still being dangerous.
Cloud Changes the Patching Model
Metabase
A vendor can detect an attack and push a fix across managed infrastructure far faster than thousands of independent administrators can respond individually.
Self-Hosting Creates Responsibility
Self-hosting gives organizations greater control, but that control comes with greater security responsibility.
The customer becomes responsible for monitoring, patching, logging, hardening, and incident response.
Firewalls Need Monitoring Too
Security appliances should not be treated as invisible infrastructure.
They generate valuable logs and can reveal scanning, repeated malformed requests, authentication attacks, and abnormal traffic patterns.
Network Security Devices Are High-Value Targets
Compromising or disrupting a firewall can affect an entire organization.
That makes security appliances strategically attractive to attackers.
The Human Factor Still Matters
Even sophisticated vulnerability management programs can fail when nobody knows who owns a vulnerable asset.
Every critical system should have a clear technical owner.
Emergency Patching Needs Testing
Rapid patching is important, but organizations should still maintain rollback plans and change-management procedures.
A failed emergency update can create another outage.
Segmentation Can Reduce the Blast Radius
Applications such as Metabase should not automatically have unrestricted access to every database in the organization.
Network segmentation and least privilege can significantly reduce the damage caused by application compromise.
Database Permissions Matter
Metabase should receive only the database permissions it actually requires.
An analytics application rarely needs unrestricted administrative privileges across an entire database environment.
Secrets Should Be Short-Lived
Where possible, organizations should prefer temporary credentials, managed identities, vault-based secrets, and narrowly scoped access tokens over permanent passwords.
Logging Must Be Protected
Attackers may attempt to modify or delete evidence.
Critical logs should therefore be centralized and protected from the compromised system.
Incident Response Should Start Before the Incident
Organizations should already know what happens when a critical vulnerability enters CISA’s KEV catalog.
Who patches it?
Who approves emergency changes?
Who investigates exploitation?
Who communicates with management?
Automation Can Save Hours
Vulnerability scanners, endpoint management systems, configuration management tools, and SIEM automation can dramatically reduce the time between disclosure and remediation.
But Automation Needs Accurate Inventory
Automated remediation is only useful when the organization knows which assets are vulnerable.
Incomplete inventories produce false confidence.
The Deadline Is Not the Objective
August 14 and August 25 are compliance deadlines for affected federal agencies.
Security teams should not treat those dates as targets for beginning remediation.
The objective should be remediation as quickly and safely as possible.
Attackers Do Not Follow Federal Calendars
Threat actors do not wait for an
If a vulnerability is being exploited today, every unpatched exposed system represents another opportunity.
Small Organizations Face the Same Risk
Although
Attackers do not care whether the vulnerable machine belongs to a government agency or a private company.
The Most Important Lesson
The central lesson from this KEV update is simple: known exploitation should change the urgency of vulnerability management.
Three vulnerabilities can affect three different layers of infrastructure, but the defensive answer is remarkably consistent.
Find the affected assets.
Patch them.
Investigate for exploitation.
Rotate exposed secrets.
Monitor for persistence.
And verify that the attack surface has actually been reduced.
✅ CISA KEV Addition
Confirmed in the supplied article: CISA has added CVE-2026-20349, CVE-2026-68820, and CVE-2026-72898 to its Known Exploited Vulnerabilities catalog. The article correctly frames KEV inclusion as a major prioritization signal for defenders.
✅ Cisco Secure Firewall Vulnerability
Supported: CVE-2026-20349 is described as a remotely exploitable Cisco Secure Firewall ASA/FTD vulnerability capable of causing a denial-of-service condition through specially crafted HTTP requests.
✅ Windows Winsock Driver Risk
Supported: CVE-2026-68820 is described as a use-after-free vulnerability affecting afd.sys, with Microsoft reporting active exploitation and potential SYSTEM-level code execution.
✅ Metabase SQL Injection
Supported by the supplied advisory: CVE-2026-72898 is described as an unauthenticated SQL injection vulnerability affecting Metabase and associated with an attack against Metabase Cloud.
⚠️ Exploitation Does Not Automatically Mean Every Deployment Was Compromised
The existence of exploitation does not establish that every organization running an affected product has been breached. Organizations need to investigate their own telemetry, logs, credentials, and system integrity.
Prediction
(+1) KEV-Driven Emergency Patching Will Accelerate
Organizations that maintain mature vulnerability-management programs will likely prioritize these flaws rapidly, particularly where Cisco VPN infrastructure, Windows endpoints, or self-hosted Metabase deployments are exposed.
(+1) Metabase Deployments Will Receive More Security Scrutiny
The Metabase incident could push organizations to reassess how much database access their analytics platforms actually have.
(+1) Least-Privilege Controls Will Become More Important
Security teams will increasingly limit application credentials and database permissions so that compromising one analytics platform does not automatically expose an entire data environment.
(+1) Cloud-Managed Security Will Gain Another Advantage
Incidents like this demonstrate how managed platforms can deploy emergency protections faster than fragmented self-hosted environments.
(-1) Unpatched Internet-Facing Systems Will Remain High-Risk Targets
Organizations that postpone remediation until the official deadline will continue to expose themselves to unnecessary attack opportunities, particularly when vulnerabilities are already being exploited.
(+1) CISA KEV Will Continue Shaping Enterprise Patch Priorities
As attackers increasingly exploit newly disclosed vulnerabilities, organizations are likely to rely more heavily on exploitation intelligence rather than severity scores alone when deciding what gets patched first.
▶️ Related Video (72% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.twitter.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
