CISA 2026-08-11

CISA KEV — Cisco Secure Firewall Adaptive Security Appliance (CVE-2026-20349) +2 more

Machine-generated analysis · WAYSCloud LLM

CISA added CVE-2026-20349 (Cisco ASA/FTD Heap Inspection Vulnerability), CVE-2026-68820 (Microsoft WinSock Use-After-Free Vulnerability), and CVE-2026-72898 (Metabase SQL Injection Vulnerability) to its KEV Catalog.

Context

The KEV Catalog lists vulnerabilities with evidence of active exploitation. CVE-2026-20349 affects Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD). The advisory references Binding Operational Directive (BOD) 26-04, which requires FCEB agencies to prioritize remediation of high-risk vulnerabilities from the KEV Catalog.

Operator considerations

Check: Inventory systems running Cisco ASA or FTD firewalls. Check: Inventory systems running Microsoft Windows Ancillary Function Drivers. Check: Inventory systems running Metabase.

From Cybersecurity and Infrastructure Security Agency ↗

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-20349 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) Heap Inspection Vulnerability

CVE-2026-68820 Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

CVE-2026-72898 Metabase SQL Injection Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vul...

Read the full advisory on CISA →