CISA KEV Alert: Cisco ASA/FTD, Windows WinSock Driver, and Metabase SQLi Under Active Exploitation — Detection and Remediation Guide

On August 11, 2026, CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active exploitation in the wild. This is not a theoretical risk advisory — a KEV listing means adversaries are already weaponizing these flaws against real targets, and your environment is in scope if you run any of the affected products.

The three additions are:

• CVE-2026-20349 — Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) Heap Inspection Vulnerability
• CVE-2026-68820 — Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
• CVE-2026-72898 — Metabase SQL Injection Vulnerability

The composition of this batch is instructive. We have a perimeter network device (Cisco ASA/FTD), a local privilege escalation primitive in a core Windows kernel driver (afd.sys), and a web application SQL injection in a widely deployed open-source business intelligence platform. That is a full attack chain in a single advisory: initial access via edge device or web app, followed by kernel-level privilege escalation on Windows endpoints. Defenders should treat these not as three isolated bugs, but as components of an intrusion playbook that is already running.

Under Binding Operational Directive (BOD) 26-04 — Prioritizing Security Updates Based on Risk — Federal Civilian Executive Branch (FCEB) agencies are required to remediate KEV-listed vulnerabilities within the timelines CISA assigns in the catalog. Every private-sector organization should hold itself to the same standard. Check each KEV entry for the assigned due date and work backwards from it.

Technical Analysis

CVE-2026-20349 — Cisco ASA / FTD Heap Inspection Vulnerability

Cisco's Adaptive Security Appliance and Firepower Threat Defense software sit at the network perimeter of a significant share of enterprise and government networks. A memory corruption flaw in this class of device is among the highest-impact findings a defender can receive, because the device is both exposed to untrusted traffic and typically positioned with broad visibility into — and control over — internal network flows.

A heap inspection vulnerability indicates the ability for an attacker to read or manipulate heap memory on the device. From a defender's perspective, the concerns are:

• Credential and key material exposure: ASA/FTD devices hold VPN credentials, pre-shared keys, session tokens, and configuration secrets in memory. Heap disclosure can exfiltrate these without touching disk, making the compromise nearly invisible to file-based detection.
• Pre-authentication attack surface: perimeter devices process untrusted protocol traffic before authentication. Exploitation of memory-handling code paths in packet inspection or management interfaces frequently requires no valid credentials.
• Forensic opacity: ASA/FTD appliances have limited endpoint telemetry compared to Windows/Linux hosts. Memory-resident attacker activity leaves few artifacts beyond syslog anomalies, unexpected process restarts, or device reboots.

Exploitation status: Confirmed actively exploited; listed in CISA KEV.

CVE-2026-68820 — Windows Ancillary Function Driver for WinSock (afd.sys) Use-After-Free

The Ancillary Function Driver for WinSock (afd.sys) is the kernel-mode driver that underpins Windows socket operations. Every application that opens a TCP/UDP socket on Windows interacts with AFD through IOCTL calls. A use-after-free in this driver is a classic local privilege escalation (LPE) primitive: an attacker who has already achieved code execution as a low-privileged user can trigger the UAF condition to corrupt kernel memory and escalate to NT AUTHORITY\SYSTEM.

Defender-relevant characteristics:

• Post-compromise enabler: UAF bugs in afd.sys are rarely the initial access vector. They are the second stage — the attacker phishes or exploits a public-facing service, lands as a standard user or service account, then uses CVE-2026-68820 to become SYSTEM, disable EDR, dump LSASS, and move laterally.
• Exploitation requirements: local code execution. No user interaction required beyond initial foothold. Any authenticated local context is sufficient.
• Detection difficulty: the exploitation itself happens in kernel memory via crafted DeviceIoControl calls to \\Device\Afd. Host telemetry rarely captures the trigger directly. Effective detection focuses on the post-exploitation behavior: unexpected processes running as SYSTEM spawned by user-context parents, token manipulation, and security-product tampering immediately following odd socket activity.

Exploitation status: Confirmed actively exploited; listed in CISA KEV. Expect exploit code to be folded into commodity post-exploitation toolkits rapidly — kernel LPEs in afd.sys have historically been reliable and portable across Windows builds.

CVE-2026-72898 — Metabase SQL Injection

Metabase is an open-source business intelligence and analytics platform frequently deployed with direct connectivity to production databases — which is precisely what makes a SQL injection in it so dangerous. The application is designed, by intent, to execute SQL against backend data stores. A SQL injection flaw here doesn't just expose the Metabase application database; it can be pivoted against any connected data source the Metabase service account can reach.

Defender-relevant characteristics:

• Attack surface: Metabase exposes REST API endpoints (commonly under /api/) that accept query parameters, dataset definitions, and dashboard/filter inputs. Injection through these endpoints can be reachable pre-authentication or with low-privilege authenticated sessions depending on the vulnerable code path.
• Blast radius: the Metabase service account typically holds read (and sometimes write) credentials against production warehouses — PostgreSQL, MySQL, SQL Server, Snowflake, Redshift. Successful exploitation means direct SQL execution with those credentials.
• Secondary risk: Metabase instances store connection strings for all configured databases. Compromise of the application tier frequently yields credentials for every attached data source.

Exploitation status: Confirmed actively exploited; listed in CISA KEV. Internet-exposed Metabase instances should be treated as potentially already compromised until proven otherwise.

Detection & Response

The detections below are scoped to observable behavior a mature SOC can actually action. Note the deliberate emphasis: for the Cisco and Windows kernel bugs, reliable detection lives in the post-exploitation phase, not in the trigger itself. Build your hunting accordingly.

Sigma Rules

---
title: Suspicious SYSTEM Process Spawned by User-Context Parent (Potential CVE-2026-68820 Post-Exploitation)
id: 8c4a2f17-3b6d-4e91-a7c2-5d8e9f0a1b34
status: experimental
description: Detects processes running as SYSTEM spawned by parent processes executing from user-writable or non-system locations. Consistent with kernel LPE exploitation (e.g., afd.sys use-after-free) escalating a low-privilege foothold to NT AUTHORITY\SYSTEM.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/08/12
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_user:
    User|contains:
      - 'SYSTEM'
      - 'AUTORITE NT\\Syst'
  selection_parent:
    ParentImage|contains:
      - '\\AppData\\'
      - '\\Temp\\'
      - '\\Users\\Public\\'
      - '\\ProgramData\\'
      - '\\Downloads\\'
  filter_known:
    ParentImage|endswith:
      - '\\MsMpEng.exe'
      - '\\svchost.exe'
  condition: selection_user and selection_parent and not filter_known
falsepositives:
  - Legitimate software updaters executing from user directories under SYSTEM context (rare but possible with some deployment tooling)
level: high
---
title: Metabase SQL Injection Patterns in Web Request URIs (CVE-2026-72898)
id: 2f7b9d41-6a3e-4c85-b1d9-8e4f2a6c7d50
status: experimental
description: Detects SQL injection metacharacters and common injection payloads in requests targeting Metabase API endpoints. Tune the endpoint path to match your deployment and authenticated API routes.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/12
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri|contains:
      - '/api/'
  selection_payload:
    cs-uri|contains:
      - '%27'
      - 'UNION%20SELECT'
      - 'union+select'
      - 'OR%201=1'
      - 'SLEEP('
      - 'pg_sleep'
      - 'information_schema'
      - 'xp_cmdshell'
  filter_internal:
    c-ip|startswith:
      - '10.'
      - '192.168.'
  condition: selection_endpoint and selection_payload and not filter_internal
falsepositives:
  - Vulnerability scanners and authorized penetration tests — maintain a scanner IP exclusion list
  - Metabase native query features legitimately transmitting SQL fragments (tune per environment)
level: high
---
title: Security Tooling Tampering Following Privilege Escalation
id: 5e1c8a63-9d2f-4b78-c3a6-1f5e8b0d4a27
status: experimental
description: Detects attempts to stop, disable, or delete security services and their components via command line — a common action immediately following successful kernel-level privilege escalation such as CVE-2026-68820 exploitation.
references:
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/08/12
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith:
      - '\\sc.exe'
      - '\\net.exe'
      - '\\net1.exe'
      - '\\taskkill.exe'
    CommandLine|contains:
      - ' stop '
      - ' delete '
      - ' config '
      - ' disabled'
  selection_target:
    CommandLine|contains:
      - 'WinDefend'
      - 'Sense'
      - 'MsMpSvc'
      - 'SentinelAgent'
      - 'CarbonBlack'
      - 'cb'
      - 'csfalconservice'
      - 'sysmon'
  condition: selection_sc and selection_target
falsepositives:
  - Legitimate EDR management via approved deployment tooling (SCCM, Intune) — filter by managing host or service account
level: high

KQL — Microsoft Sentinel / Defender

The first query hunts the post-exploitation signature of the afd.sys UAF: SYSTEM-context processes with user-context parents. The second hunts Metabase injection attempts against web/proxy telemetry. The third pulls Cisco ASA/FTD syslog anomalies (crash, traceback, and failover indicators) via CommonSecurityLog or Syslog ingestion.

// Hunt 1: SYSTEM processes spawned from user-writable paths (post-CVE-2026-68820 behavior)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessAccountName !in~ ("system", "local service", "network service")
| where AccountName =~ "SYSTEM"
| where InitiatingProcessFolderPath has_any ("\\AppData\\", "\\Temp\\", "\\Users\\Public\\", "\\ProgramData\\", "\\Downloads\\")
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath,
          InitiatingProcessFileName, InitiatingProcessFolderPath,
          InitiatingProcessAccountName, InitiatingProcessCommandLine, ProcessCommandLine
| order by TimeGenerated desc;

// Hunt 2: SQL injection patterns against Metabase API endpoints (ingested via proxy/WAF CEF)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("/api/")
| where RequestURL has_any ("%27", "UNION%20SELECT", "union+select", "OR%201=1",
                            "SLEEP(", "pg_sleep", "information_schema", "xp_cmdshell",
                            "extractvalue", "updatexml")
| summarize Requests = count(), DistinctURIs = dcount(RequestURL)
            by SourceIP, DestinationHostName, bin(TimeGenerated, 1h)
| order by Requests desc;

// Hunt 3: Cisco ASA/FTD crash and integrity anomaly indicators via syslog
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName has_any ("ASA", "FTD", "%ASA")
| where SyslogMessage has_any ("crashinfo", "traceback", "heap", "memory corruption",
                               "unexpected reload", "fatal", "watchdog")
| project TimeGenerated, Computer, HostIP, SeverityLevel, SyslogMessage
| order by TimeGenerated desc;

Velociraptor VQL

For suspected CVE-2026-68820 exploitation on a Windows host, collect live process and network state to identify user-context processes holding unexpected socket handles or parent-child anomalies consistent with privilege escalation:

-- Hunt for privilege escalation indicators: user-context processes with
-- suspicious children, and anomalous socket-holding processes (afd.sys abuse surface)
LET proc_hunt = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Username =~ 'SYSTEM'
  AND Exe =~ '(AppData|Temp|Users\\\\Public|ProgramData|Downloads)'

LET socket_hunt = SELECT Pid, Name, Status, Family, Address, Port, Type
FROM netstat()
WHERE Status = 'LISTEN'
  AND Port > 1024
  AND NOT Name =~ '(svchost|lsass|services|spoolsv|MsMpEng|winlogon)'

SELECT * FROM proc_hunt
UNION ALL
SELECT Pid, NULL AS Ppid, Name, NULL AS Exe,
       format(format='%v %v:%v', args=[Address, Port, Status]) AS CommandLine,
       NULL AS Username, NULL AS CreateTime
FROM socket_hunt

Verification and Remediation Script

Use the following PowerShell to audit Windows endpoints for applicable cumulative update coverage (CVE-2026-68820), and the Bash snippet to inventory Metabase deployment versions and confirm Cisco ASA/FTD software trains. Always validate exact fixed versions against the official vendor advisories linked in the Remediation section.

# === CVE-2026-68820: Verify Windows update coverage ===
# Check installed hotfixes from the August 2026 (or later) cumulative updates
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date "2026-08-01") } |
  Select-Object HotFixID, Description, InstalledOn | Sort-Object InstalledOn -Descending

# Confirm afd.sys file version for vendor advisory comparison
$afd = Get-Item "$env:SystemRoot\System32\drivers\afd.sys"
"afd.sys version: $($afd.VersionInfo.FileVersion)"
"Last write: $($afd.LastWriteTime)"

# Query pending reboot state (kernel driver patches require reboot)
Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired"

# === CVE-2026-72898: Locate Metabase instances on Windows hosts (if self-hosted) ===
Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -match 'metabase' } |
  Select-Object ProcessId, Name, CommandLine

# === CVE-2026-72898: Identify Metabase version (container and JVM deployments) ===
docker ps --format '{{.Names}} {{.Image}}' | grep -i metabase
# For JAR deployments, check the running version endpoint:
curl -s http://localhost:3000/api/health ; echo
# Review exposed instances — Metabase should NOT be internet-facing:
ss -tlnp | grep -E '3000|metabase'

# === CVE-2026-20349: Cisco ASA/FTD — verify software train against Cisco advisory ===
# On the ASA CLI:
#   show version
#   show crashinfo
#   show failover state
# Compare the running train against the fixed releases in Cisco's security advisory.
# Check for recent unexplained reloads:
#   show uptime
#   dir disk0:/crashinfo*

Remediation

1. Establish your KEV clock immediately. Pull the three KEV entries from the CISA KEV Catalog and note the assigned remediation due dates. FCEB agencies are bound by BOD 26-04; treat those dates as your own internal SLA. Source alert: CISA Adds Three Known Exploited Vulnerabilities to Catalog.

2. CVE-2026-20349 (Cisco ASA/FTD):

• Consult Cisco's security advisory for the fixed software trains for your hardware (ASA 5500-X, Firepower appliances, virtual FTD). Upgrade to the exact fixed release listed — do not assume the latest train is sufficient without advisory confirmation.
• If patching must be deferred: restrict management-plane access (HTTPS/SSH/ASDM) to a dedicated management VRF/network, disable any unused remote-access VPN profiles, and ensure no management interface is reachable from untrusted networks.
• Because heap disclosure can expose credentials, rotate VPN pre-shared keys, local device credentials, and any certificates resident on the device after patching — especially if the device was internet-exposed.
• Audit crashinfo files, uptime history, and TACACS/RADIUS authentication logs for anomalies predating the patch.

3. CVE-2026-68820 (Windows afd.sys UAF):

• Deploy the Microsoft security update addressing CVE-2026-68820 via your normal cumulative update channel (WSUS/Intune/Windows Update). Kernel driver fixes require a reboot — track pending-reboot state, not just patch installation.
• Prioritize systems where low-privilege code execution is most likely: user workstations, jump boxes, terminal servers/RDSH, and any host running third-party services under service accounts.
• After patching, validate afd.sys file version against the advisory's fixed version on a sample of hosts per OS build.
• Because this is a post-exploitation primitive, hunt for prior compromise on critical hosts before assuming the patch closed the loop.

4. CVE-2026-72898 (Metabase SQLi):

• Upgrade Metabase to the fixed release identified in the Metabase security advisory (check github.com/metabase/metabase/security/advisories and the official releases page). This applies equally to the open-source JAR and Docker deployments.
• Remove Metabase from direct internet exposure. Place it behind authenticated reverse proxy or VPN access.
• Rotate the database credentials Metabase uses to connect to every configured data source, and rotate any admin/API tokens stored in the Metabase application database.
• Review Metabase query audit logs and upstream database logs for anomalous queries (metadata enumeration against information_schema, bulk reads, out-of-hours activity).

5. Compensating controls while patching: increase logging retention on perimeter syslog, ensure web proxy/WAF logs capture full request URIs for Metabase endpoints, and confirm EDR coverage with tamper protection on all Windows endpoints.

The pattern in this KEV batch — edge device memory disclosure, kernel LPE, and application-tier SQL injection — mirrors the intrusion chains we see in real ransomware and espionage engagements. Remediating all three within the BOD window isn't compliance theater; it's closing doors that are, as of this writing, actively being walked through.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub