CVE-2026-20349

The Canadian Centre for Cyber Security published four security advisories on August 13, 2026. The most critical is CVE-2026-20349, a high-severity denial-of-service vulnerability in Cisco ASA and FTD SSL VPN services that is being actively exploited in the wild. Additional advisories cover vulnerabilities in AMD software, GitLab, and WebPros Plesk, the latter involving a privilege escalation flaw via database cloning.

CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. The vulnerabilities span Cisco Secure Firewall ASA/FTD (heap inspection), Microsoft Windows AFD WinSock (use-after-free), and Metabase (SQL injection). Federal agencies are required to remediate these on publicly exposed assets under BOD 26-04, and CISA encourages all organizations to prioritize patching.