On August 11, 2026, CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog. The affected products occupy very different positions: a perimeter security appliance, a Windows kernel networking driver, and a business-intelligence application connected to databases. The common factor is evidence of exploitation.
- CVE-2026-20349 — Cisco Secure Firewall ASA and FTD.
- CVE-2026-68820 — Microsoft Windows Ancillary Function Driver for WinSock.
- CVE-2026-72898 — Metabase SQL injection.
KEV inclusion should change both patch priority and the investigation question. The goal is not only “are we fixed?” but also “were we exposed before the fix?”
CVE-2026-20349: Cisco ASA and FTD
Cisco ASA and FTD devices commonly sit at the network edge and may terminate VPN sessions or control access between networks. Compromise of a perimeter device can expose credentials, configuration secrets, session information, and trusted network paths.
Inventory all ASA and FTD appliances, including standby devices and virtual instances. Compare the running software train with Cisco’s advisory, verify whether affected services were reachable from untrusted networks, and review uptime, crash information, configuration changes, authentication logs, and unexplained failovers or reloads.
Do not assume that upgrading the active device automatically covered the standby member or an out-of-band management interface.
CVE-2026-68820: Windows WinSock driver
The Windows Ancillary Function Driver for WinSock, commonly associated with afd.sys, operates in the kernel networking path. A use-after-free flaw in this component can support privilege escalation after an attacker already has code execution in a lower-privileged context.
Deploy the applicable August Windows security update and complete the required reboot. Prioritize workstations, jump hosts, terminal servers, build systems, and servers where an application account could provide an initial foothold.
For high-value systems, hunt for unexpected processes running as SYSTEM, token manipulation, security-tool tampering, credential dumping, and administrative actions from user-writable locations. Patch installation closes the vulnerability but does not undo earlier elevation.
CVE-2026-72898: Metabase SQL injection
Metabase is often connected to production databases and data warehouses. A SQL injection flaw in the application can therefore have a blast radius larger than the web server itself. Review every configured data source, service-account permission, stored connection, and internet-exposure path.
Upgrade to the fixed Metabase release identified by the vendor. Remove direct public exposure where possible, restrict access through an approved identity-aware gateway or VPN, and examine Metabase and upstream database logs for unusual queries, schema enumeration, bulk reads, new users, or access outside normal hours.
If exploitation is suspected, rotate database credentials and application secrets after containment. A read-only database account reduces impact, but large-scale data theft can still be severe.
A practical triage order
- External exposure first. Identify internet-reachable Cisco and Metabase systems immediately.
- Control-plane importance. Prioritize devices and applications that hold credentials or reach many downstream assets.
- Patch and reboot. Confirm the actual running version and reboot state, not only deployment status.
- Retrospective review. Establish the vulnerable exposure window and preserve the logs needed to examine it.
- Credential response. Rotate secrets when evidence suggests memory, database, or administrative compromise.
Evidence table
| Vulnerability | Key evidence | Likely owner |
|---|---|---|
| Cisco ASA/FTD | Running version, exposure, crash data, config and auth logs | Network security |
| Windows AFD | Installed update, reboot, SYSTEM process anomalies, EDR tampering | Endpoint and server teams |
| Metabase | App version, public exposure, query logs, connected-database activity | Data platform and application security |
Do not flatten KEV into a score
A KEV entry reflects known exploitation, not a universal ranking of every affected asset. A non-public Metabase instance with least-privileged credentials may be less urgent than a vulnerable VPN appliance open to the internet. Conversely, a heavily used internal analytics server with access to sensitive warehouses may justify immediate action even without public exposure.
Use KEV status, reachability, privilege, data access, and evidence retention together. That produces a defensible order and a better incident record than sorting by CVSS alone.
Sources
- CISA: August 11 KEV additions
- CISA Known Exploited Vulnerabilities Catalog
- Microsoft August 2026 security updates
