CISA Puts Deadlines on Three Live Exploits, Including a Confirmed Metabase Cloud 0-Day

CISA has added three vulnerabilities to its Known Exploited Vulnerabilities catalog: a remote denial-of-service flaw in Cisco Secure Firewall ASA and FTD, a use-after-free in the Windows Winsock kernel driver, and an unauthenticated SQL injection in Metabase ^[1][2][5][7]. Under Binding Operational Directive 22-01, federal civilian agencies must remediate KEV entries by their assigned due dates, which puts fixed calendar pressure on all three ^[11].

CVE-2026-20349 affects Cisco Secure Firewall ASA and FTD software and lets an unauthenticated remote attacker crash the device ^[2]. The root cause is insufficient error checking when processing HTTP requests, and the attack path is a crafted request to the Remote Access SSL VPN service, which forces the firewall to reload and interrupts network access ^[3][4]. That is worth sitting with: the exposed service is the one many organisations use to reach the network in the first place.

CVE-2026-68820 is a use-after-free in afd.sys, the kernel-mode driver behind the Windows Sockets API, and it can be used to execute code with SYSTEM privileges ^[5][6]. Microsoft says it is actively exploited, while its own CVSS assessment lists exploit maturity as "Unproven" ^[6]. Operators triaging this by scorecard alone will get the wrong answer.

CVE-2026-72898 lets an unauthenticated attacker inject arbitrary SQL directly into the Metabase application database ^[7]. Metabase's advisory states: "We recently identified that Metabase Cloud was attacked by someone utilizing an unknown (0-day) security vulnerability in versions 1.58 and above. We immediately blocked the endpoints used for the attack, then quickly identified and patched the vulnerability." ^[8] According to the SecurityAffairs write-up, database access is only the entry point: an attacker can take administrator rights over the instance, alter application configuration, steal stored credentials for every connected database, and read and exfiltrate whatever those connections reach ^[9]. For a business intelligence tool wired into a company's data warehouses, the credential store is the prize, not the dashboards.

The split in exposure matters. Metabase says it detected the attack, blocked the abused endpoint, and patched it, and that cloud instances were already running the fixed version when the advisory went public ^[10]. Self-hosted deployments on affected versions got none of that, which makes this an urgent job rather than a routine one ^[10].

The deadlines are August 14, 2026 for the Cisco and Metabase flaws, and August 25 for the Windows Winsock bug ^[12]. That is 11 extra days for the only one of the three that hands over SYSTEM ^[13]. CISA also recommends that private organisations work the catalog rather than treat it as a federal artefact ^[14].