7 minhigh
CISA Adds Three Known Exploited Vulnerabilities to Catalog (CVE-2026-20349, CVE-2026-68820, CVE-2026-72898)
CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. The vulnerabilities span Cisco Secure Firewall ASA/FTD (heap inspection), Microsoft Windows AFD WinSock (use-after-free), and Metabase (SQL injection). Federal agencies are required to remediate these on publicly exposed assets under BOD 26-04, and CISA encourages all organizations to prioritize patching.
Sens:■ ImmediateConf:
Showing defanged values
- cveCVE-2026-20349Heap inspection vulnerability in Cisco Secure Firewall ASA and FTD that is being actively exploited.
- cveCVE-2026-68820Use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock that is being actively exploited.
- cveCVE-2026-72898SQL injection vulnerability in Metabase that is being actively exploited.
Detection / Hunteropenrouter
What Happened
A U.S. government cybersecurity agency has flagged three security flaws that attackers are already exploiting in the wild. The flaws affect Cisco firewall products, a core component of Microsoft Windows, and the Metabase data analytics tool. Government agencies are required to fix these issues quickly on internet-facing systems and to check whether attackers may have already broken in. The agency recommends that all organizations, not just government ones, treat these vulnerabilities as high priority and apply available patches or mitigations as soon as possible.
Key Takeaways
- CISA added three vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation.
- CVE-2026-20349 affects Cisco Secure Firewall ASA and FTD via a heap inspection vulnerability.
- CVE-2026-68820 is a use-after-free vulnerability in the Microsoft Windows Ancillary Function Driver for WinSock.
- CVE-2026-72898 is a SQL injection vulnerability in Metabase.
- BOD 26-04 requires FCEB agencies to prioritize remediation of KEV-listed CVEs on publicly exposed assets and to check for prior compromise.
Affected Systems
- Cisco Secure Firewall Adaptive Security Appliance (ASA)
- Cisco Secure Firewall Threat Defense (FTD)
- Microsoft Windows (Ancillary Function Driver for WinSock)
- Metabase
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-20349 | Cisco Secure Firewall ASA and FTD | Heap inspection vulnerability in Cisco Secure Firewall ASA and FTD that is being actively exploited. | |
| CVE-2026-68820 | Microsoft Windows Ancillary Function Driver for WinSock | Use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock that is being actively exploited. | |
| CVE-2026-72898 | Metabase | SQL injection vulnerability in Metabase that is being actively exploited. |
Attack Chain
- Initial Access: Attackers exploit one of three KEV-listed vulnerabilities (Cisco ASA/FTD heap inspection, Windows AFD WinSock use-after-free, or Metabase SQL injection) on an exposed asset.
- Execution: Successful exploitation grants the attacker control or access to the vulnerable component.
- Persistence: Post-exploitation, attackers may establish footholds before the asset owner applies remediation.
- Remediation Gap: Organizations that delay patching remain exposed to continued exploitation.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article is a KEV catalog update notification and does not include detection rules or queries. Organizations should consult vendor advisories for Cisco, Microsoft, and Metabase for specific detection guidance.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR may detect post-exploitation behavior resulting from these vulnerabilities, but the exploitation of network-facing services like Cisco ASA/FTD and Metabase may occur outside the endpoint telemetry scope. Windows AFD WinSock exploitation would likely produce kernel-level indicators that some EDR products can capture. |
| Network Visibility | Medium | Network monitoring may detect exploitation attempts against Cisco ASA/FTD and Metabase if IDS signatures exist for the specific CVEs. The article does not provide network-level indicators. |
| Detection Difficulty | Moderate | Detection requires vendor-specific signatures or behavioral rules for each CVE. Without published detection rules in this article, organizations must develop or source their own content for each affected product. |
Required Log Sources
- Cisco ASA/FTD system logs
- Windows Event Logs (System, Security)
- Metabase application logs
- Web server access logs for Metabase instances
- EDR telemetry for Windows endpoints
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for exploitation of Metabase SQL injection by looking for anomalous SQL query patterns or unexpected HTTP requests to Metabase endpoints that contain SQL syntax. | Metabase application logs, web server access logs, WAF logs | Initial Access | Medium — legitimate analytical queries may contain complex SQL syntax that resembles injection attempts. |
| Consider hunting for Windows AFD WinSock exploitation by looking for kernel-level crashes, unexpected kernel-mode process creation, or privilege escalation events following abnormal socket operations. | EDR kernel telemetry, Windows Event Log (System, Security), crash dumps | Privilege Escalation | Low to Medium — kernel-level anomalies are less common in normal operations but may overlap with legitimate driver activity. |
| Consider hunting for Cisco ASA/FTD exploitation by monitoring for unexpected administrative sessions, configuration changes, or anomalous heap-related crash logs on firewall appliances. | Cisco ASA/FTD syslog, firewall management logs, network flow data | Initial Access | Low — administrative configuration changes are typically well-documented and infrequent. |
Control Gaps
- Network IDS/IPS may lack signatures for these specific CVEs if vendor rules are not yet deployed.
- EDR coverage may not extend to network appliances such as Cisco ASA/FTD.
- Metabase application-level logging may not be enabled or forwarded to a central SIEM in many environments.
Key Behavioral Indicators
- Unexpected privilege escalation on Windows hosts following network socket activity (T1068 context for CVE-2026-68820)
- Anomalous HTTP requests containing SQL syntax directed at Metabase application endpoints (T1190 context for CVE-2026-72898)
- Unexpected administrative access or configuration changes on Cisco ASA/FTD appliances (T1190 context for CVE-2026-20349)
False Positive Assessment
Low — the article identifies specific CVEs with confirmed active exploitation; however, detection content for these CVEs must be sourced from vendor advisories and may carry moderate false positive risk depending on implementation.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Identify all internet-facing assets running Cisco ASA/FTD, Microsoft Windows, and Metabase, and prioritize patching or applying vendor-provided mitigations for CVE-2026-20349, CVE-2026-68820, and CVE-2026-72898.
- If internet exposure of Metabase or Cisco ASA/FTD management interfaces is not required, consider restricting access to trusted IP ranges or placing them behind a VPN.
- For assets that cannot be immediately patched, evaluate whether vendor-provided virtual patches or configuration changes are available to reduce exposure.
- Consider reviewing logs on affected assets for indicators of prior compromise, particularly if the vulnerabilities were exploitable before patches were available.
Infrastructure Hardening
- Evaluate whether your vulnerability management program tracks CISA KEV Catalog additions and automatically prioritizes remediation for listed CVEs.
- Consider implementing network segmentation to limit the blast radius of internet-facing services such as Metabase and Cisco firewall management interfaces.
- If supported by your tooling, consider deploying IDS/IPS signatures for these CVEs as they become available from your security vendor.
User Protection
- Ensure Windows endpoints receive the latest security updates through your patch management process, particularly for kernel driver components.
- If your organization uses Metabase, verify whether it is deployed on internet-facing infrastructure and consider moving it to an internal-only network segment.
Security Awareness
- Consider briefing IT and security teams on the three newly added KEV vulnerabilities and the importance of rapid remediation for actively exploited flaws.
- If your organization has a vulnerability management policy, evaluate whether it aligns with risk-based prioritization principles similar to those in BOD 26-04.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping2 techniques
Tactic
Initial Access
Tactic
Privilege Escalation
Related
- CISA Adds Seven Known Exploited Vulnerabilities to Catalog (CVE-2026-9586, CVE-2026-48710, CVE-2026-49869 +4 more)·2
- CISA Adds Six Known Exploited Vulnerabilities to Catalog (CVE-2015-3246, CVE-2015-5287, CVE-2019-1068 +3 more)·2
- CISA Adds Four Known Exploited Vulnerabilities to Catalog (CVE-2026-33824, CVE-2026-55040, CVE-2026-59310 +1 more)·2
Stay currentSubscribe via RSS
