CISA has added three new vulnerabilities to the Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation across network perimeter devices, Windows endpoints, and a widely deployed open-source analytics platform. This batch is notable for its breadth: it spans edge infrastructure (Cisco), the operating system layer (Microsoft), and the application layer (Metabase) — a combination that mirrors the full attack chains we observe from initial-access brokers feeding ransomware operators.
Treat all three as immediate-action items. CISA does not add CVEs to the KEV on speculation; inclusion means confirmed exploitation.
Active Exploitation Intelligence
CVE-2026-20349 — Cisco Secure Firewall ASA / FTD Heap Inspection Vulnerability
What it is: A heap inspection vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Flaws in Cisco's firewall line — particularly memory corruption and improper memory handling in inspection engines — have historically allowed remote code execution or denial of service against the very devices enforcing perimeter policy.
Exploitation method: Heap-level memory corruption reachable through the firewall's traffic inspection path. Depending on exploitation primitives, this class of flaw typically enables remote code execution on the appliance itself or persistent denial of service that blinds perimeter defenses — both catastrophic outcomes for an edge device.
Threat actors: No specific attribution has been published; CISA lists ransomware use as Unknown. However, Cisco ASA/FTD flaws are a well-documented favorite of Chinese state-nexus actors (e.g., the ArcaneDoor/UAT4356 campaigns against CVE-2024-20353/20359) and ransomware initial-access brokers who prize firewall implants for persistence that survives endpoint reimaging. Expect rapid weaponization by both camps.
PoC status: No public proof-of-concept confirmed at time of writing. Given active exploitation, working exploit code exists in private hands.
CISA required action: Apply vendor mitigations per Cisco's security advisory or discontinue use of the product if mitigations are unavailable. Federal agencies are bound to the remediation due date published in the KEV catalog entry (typically ~3 weeks from addition for most CVEs, shorter for edge devices).
Priority assessment: CRITICAL — highest priority in this batch. Edge devices are unpatchable-by-delay in many orgs and are the highest-value target.
CVE-2026-68820 — Microsoft Windows Ancillary Function Driver for WinSock (afd.sys) Use-After-Free
What it is: A use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel-mode driver underpinning Winsock socket operations.
Exploitation method: Local privilege escalation (LPE). An authorized (i.e., already-authenticated, low-privilege) attacker can trigger the UAF to execute code in kernel context, escalating to SYSTEM. This is a classic post-compromise EoP primitive.
Threat actors: Unattributed; ransomware flag Unknown. UAF bugs in afd.sys are a recurring, heavily abused class — CVE-2023-21768 and CVE-2024-38193 in the same driver were both exploited in the wild. Ransomware operators and APT intrusion sets chain these LPEs after initial access to disable EDR, dump credentials, and deploy payloads at scale.
PoC status: No public PoC confirmed, but afd.sys UAF exploitation techniques are extensively documented, lowering the bar for independent exploit development.
CISA required action: Apply the Microsoft security update per the KEV entry's binding due date.
Priority assessment: HIGH. Not remotely exploitable on its own, but assume every intrusion in your environment attempts this escalation until patched. Every unpatched Windows host is a lateral-movement and ransomware-staging enabler.
CVE-2026-72898 — Metabase Unauthenticated SQL Injection
What it is: A SQL injection vulnerability in Metabase, the popular open-source business intelligence platform. An unauthenticated remote attacker can inject arbitrary SQL into the Metabase application's backend database.
Exploitation method: Unauthenticated remote SQLi. Impact depends on the backing database, but Metabase historically runs with database accounts that have broad access — and on some backends (e.g., H2, as abused in CVE-2023-38646, or PostgreSQL with COPY FROM PROGRAM) SQLi escalates directly to remote code execution. At minimum, expect full data exfiltration of connected data sources.
Threat actors: Unattributed; ransomware flag Unknown. Metabase is frequently internet-exposed for dashboard sharing, and the 2023 CVE-2023-38646 exploitation wave (CISA KEV, exploited by multiple actors including financially motivated groups) demonstrated how quickly Metabase CVEs are mass-scanned and weaponized. Expect the same pattern here.
PoC status: No public PoC confirmed. SQL injection against a known parameter is among the fastest vulnerability classes to reverse and weaponize — assume days, not weeks.
CISA required action: Apply vendor mitigations per Metabase's advisory by the KEV binding due date.
Priority assessment: CRITICAL for any internet-exposed instance. Unauthenticated + remote + trivially weaponizable = mass exploitation risk.
Affected Organizations Assessment
Exposed Environments
- Cisco ASA/FTD: Any organization using Cisco firewalls as perimeter VPN concentrators or edge enforcement. This is effectively the majority of mid-to-large enterprises and government agencies. Devices with web management interfaces (ASDM/REST API) exposed, or running older software trains, are at highest risk.
- Windows WinSock (afd.sys): All supported Windows client and server versions until patched. Universal exposure — the question is not if you're affected but how fast you patch.
- Metabase: Organizations self-hosting Metabase for BI/analytics, particularly instances exposed to the internet for external dashboard access, or reachable from low-trust network segments. Docker deployments and long-lived instances running outdated versions are the primary risk pool.
Exposure Scale
Patch adoption for network appliances historically lags endpoints by weeks to months due to maintenance-window constraints and failover complexity — meaning Cisco ASA/FTD exposure will persist long after the patch drops. Windows fleet patching via WSUS/Intune typically achieves ~60–80% coverage in the first week for disciplined enterprises, but legacy and excluded systems (OT, servers pinned to old builds) create durable gaps — exactly the systems ransomware crews hunt. Metabase self-hosted instances are frequently "shadow IT," deployed by data teams outside central IT patch management, and our assessment is that a significant share of internet-facing Metabase instances run versions months or years out of date.
Fastest-Exploited Sectors
Historically, edge-device CVEs (Cisco, Fortinet, Ivanti, Palo Alto) see the fastest exploitation against government, defense, telecom, healthcare, and financial services — sectors where nation-state actors maintain persistent targeting. Ransomware crews hit healthcare, manufacturing, education, and local government hardest via edge access + Windows EoP chains. Application-layer bugs like the Metabase SQLi are mass-exploited indiscriminately, with initial access sold onward into all sectors via access brokers.
Detection Engineering
Sigma Rules
---
title: Cisco ASA/FTD Suspicious Post-Exploitation Command Execution
id: 7f2a1c94-3b6e-4f1a-9c2d-20260811a001
status: experimental
description: Detects suspicious command execution patterns on Cisco ASA/FTD devices consistent with post-exploitation activity following heap corruption attacks (CVE-2026-20349), including unexpected shell invocation, config exfiltration, and anomalous copy/write operations.
author: Security Arsenal Threat Intel
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/08/11
logsource:
product: cisco
service: asa
detection:
selection_commands:
Message|contains:
- 'copy running-config'
- 'copy startup-config'
- 'write memory'
- 'show running-config'
- 'debug menu'
- 'changeto context'
selection_tftp:
Message|contains:
- 'tftp://'
- 'ftp://'
- 'scp://'
condition: selection_commands and selection_tftp
falsepositives:
- Legitimate config backups by automation (Ansible, RANCID, Oxidized) — whitelist known backup source IPs
level: high
tags:
- attack.t1059
- attack.t1048
- attack.t1005
- cve.2026-20349
---
title: Windows WinSock AFD Use-After-Free Exploitation - Suspicious Driver and Token Manipulation
id: 7f2a1c94-3b6e-4f1a-9c2d-20260811a002
status: experimental
description: Detects behaviors consistent with exploitation of CVE-2026-68820 (afd.sys use-after-free) including rapid socket churn followed by privilege escalation to SYSTEM, suspicious NamedPipe impersonation, and non-standard processes spawning as SYSTEM shortly after low-privilege execution.
author: Security Arsenal Threat Intel
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/08/11
logsource:
category: process_creation
product: windows
detection:
selection_system_spawn:
User|contains: 'SYSTEM'
ParentImage|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\wscript.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
selection_suspicious_children:
Image|endswith:
- '\whoami.exe'
- '\net.exe'
- '\nltest.exe'
- '\vssadmin.exe'
- '\wevtutil.exe'
- '\bcdedit.exe'
condition: selection_system_spawn and selection_suspicious_children
falsepositives:
- Management agents and SCCM running discovery commands as SYSTEM — tune by parent process path
level: high
tags:
- attack.t1068
- attack.t1134
- attack.t1078
- cve.2026-68820
---
title: Metabase Unauthenticated SQL Injection Exploitation Attempts
id: 7f2a1c94-3b6e-4f1a-9c2d-20260811a003
status: experimental
description: Detects HTTP requests to Metabase API endpoints containing SQL injection patterns consistent with CVE-2026-72898 exploitation, including UNION-based, time-based, and stacked-query injection from unauthenticated sources.
author: Security Arsenal Threat Intel
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/08/11
logsource:
category: webserver
detection:
selection_uri:
cs-uri|contains:
- '/api/'
- '/api/session'
- '/api/dataset'
- '/api/card'
- '/api/native'
selection_sqli:
cs-uri-query|contains:
- 'UNION SELECT'
- 'union%20select'
- 'pg_sleep'
- 'SLEEP('
- 'BENCHMARK('
- 'WAITFOR DELAY'
- 'COPY FROM PROGRAM'
- 'xp_cmdshell'
- 'information_schema'
- "'; DROP"
- '1=1--'
- "' OR '"
condition: selection_uri and selection_sqli
falsepositives:
- Authenticated security scanning from approved scanner IPs — whitelist scanner ranges
level: critical
tags:
- attack.t1190
- attack.t1059
- attack.t1041
- cve.2026-72898
KQL (Microsoft Sentinel)
This hunt query surfaces exploitation indicators across all three CVEs: post-exploitation SYSTEM escalation on Windows (CVE-2026-68820), SQLi patterns against Metabase in web/proxy logs (CVE-2026-72898), and anomalous outbound connections from network-device segments consistent with Cisco firewall compromise (CVE-2026-20349).
let Lookback = 7d;
let SqliPatterns = dynamic(["UNION SELECT", "union%20select", "pg_sleep", "SLEEP(", "BENCHMARK(", "WAITFOR DELAY", "COPY FROM PROGRAM", "xp_cmdshell", "information_schema", "'; DROP", "1=1--"]);
let MetabaseSqli =
(union isfuzzy=true
(W3CIISLog
| where TimeGenerated > ago(Lookback)
| where csUriStem has "/api/"
| extend Query = tostring(csUriQuery)
| where Query has_any (SqliPatterns)
| project TimeGenerated, cIP, sIP, csUriStem, Query, scStatus, csUserAgent, Source = "IIS"),
(CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where RequestURL has "/api/" and RequestURL has_any (SqliPatterns)
| project TimeGenerated, cIP = SourceIP, sIP = DestinationIP, csUriStem = RequestURL, Query = RequestURL, scStatus = "", csUserAgent = RequestClientApplication, Source = "Proxy/Firewall"));
let WindowsEoP =
SecurityEvent
| where TimeGenerated > ago(Lookback)
| where EventID == 4688
| where SubjectUserName =~ "SYSTEM" or NewProcessName has "SYSTEM"
| extend CmdLine = tostring(parse_json(EventData).CommandLine)
| where CommandLine has_any ("whoami", "vssadmin", "bcdedit", "wevtutil", "net user", "nltest")
| where ParentProcessName has_any ("cmd.exe", "powershell.exe", "wscript.exe", "rundll32.exe")
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine, Source = "Windows-EoP";
let NetworkDeviceAnomaly =
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where DeviceVendor =~ "Cisco" and DeviceProduct has_any ("ASA", "Firepower", "FTD")
| where Message has_any ("copy running-config", "tftp://", "debug menu", "changeto context")
| project TimeGenerated, SourceIP, DestinationIP, Message, Source = "Cisco-ASA/FTD";
union isfuzzy=true MetabaseSqli, WindowsEoP, NetworkDeviceAnomaly
| sort by TimeGenerated desc
Remediation & Inventory Script (PowerShell)
The following script inventories exposure across the three CVEs: it checks Windows patch status, scans the network for reachable Metabase instances, and enumerates Cisco ASA/FTD management interfaces for follow-up validation. Run from a privileged management host with network reachability to target segments.
#Requires -RunAsAdministrator
# Security Arsenal - KEV 2026-08-11 Batch Inventory & Validation Script
# Covers: CVE-2026-68820 (Windows afd.sys), CVE-2026-72898 (Metabase), CVE-2026-20349 (Cisco ASA/FTD)
$ErrorActionPreference = 'SilentlyContinue'
$ReportPath = "C:\Temp\KEV_20260811_Inventory_$(Get-Date -Format 'yyyyMMdd_HHmm').csv"
New-Item -ItemType Directory -Path "C:\Temp" -Force | Out-Null
$Results = @()
Write-Host "[*] === CVE-2026-68820: Windows afd.sys UAF - Patch Status ===" -ForegroundColor Cyan
# 1. Check OS build and installed hotfixes (last 30 days)
$OS = Get-CimInstance Win32_OperatingSystem
$RecentHotfixes = Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-45) } |
Sort-Object InstalledOn -Descending
Write-Host " Host: $($OS.CSName) | Build: $($OS.BuildNumber).$($OS.UBR)"
if ($RecentHotfixes) {
Write-Host " Recent cumulative updates installed:" -ForegroundColor Green
$RecentHotfixes | Select-Object -First 5 | ForEach-Object {
Write-Host " - $($_.HotFixID) installed $($_.InstalledOn.ToString('yyyy-MM-dd'))"
}
} else {
Write-Host " [!] NO cumulative updates installed in last 45 days - host likely EXPOSED to CVE-2026-68820" -ForegroundColor Red
}
# 2. Verify afd.sys version (post-patch file version should exceed your August 2026 baseline)
$AfdPath = "$env:SystemRoot\System32\drivers\afd.sys"
if (Test-Path $AfdPath) {
$AfdVersion = (Get-Item $AfdPath).VersionInfo.FileVersion
Write-Host " afd.sys version: $AfdVersion"
$Results += [PSCustomObject]@{
Check = 'CVE-2026-68820 afd.sys'; Target = $env:COMPUTERNAME
Detail = "Version $AfdVersion"; Status = if ($RecentHotfixes) { 'Review version vs MS advisory' } else { 'EXPOSED - no recent patches' }
}
}
# 3. Trigger Windows Update scan for pending security updates
Write-Host " [*] Querying pending security updates..."
$UpdateSession = New-Object -ComObject Microsoft.Update.Session
$Searcher = $UpdateSession.CreateUpdateSearcher()
$Pending = $Searcher.Search("IsInstalled=0 and Type='Software' and IsHidden=0").Updates
$SecurityPending = $Pending | Where-Object { $_.Title -match 'Security|Cumulative' }
if ($SecurityPending) {
Write-Host " [!] $($SecurityPending.Count) security/cumulative updates PENDING - deploy immediately" -ForegroundColor Red
$SecurityPending | ForEach-Object { Write-Host " - $($_.Title)" }
$Results += [PSCustomObject]@{ Check='CVE-2026-68820 Pending Updates'; Target=$env:COMPUTERNAME; Detail=($SecurityPending.Title -join '; '); Status='ACTION REQUIRED' }
} else {
Write-Host " [+] No pending security updates detected" -ForegroundColor Green
}
Write-Host "`n[*] === CVE-2026-72898: Metabase Instance Discovery ===" -ForegroundColor Cyan
# 4. Discover Metabase instances - local services, Docker, and network scan of common subnets
# Local service check
$MbService = Get-Service | Where-Object { $_.DisplayName -match 'Metabase' }
if ($MbService) {
Write-Host " [!] Local Metabase service found: $($MbService.DisplayName) - verify version >= patched release" -ForegroundColor Yellow
$Results += [PSCustomObject]@{ Check='CVE-2026-72898'; Target=$env:COMPUTERNAME; Detail="Service: $($MbService.DisplayName)"; Status='VERIFY VERSION' }
}
# Docker check
if (Get-Command docker -ErrorAction SilentlyContinue) {
docker ps --format '{{.Names}} {{.Image}}' | Where-Object { $_ -match 'metabase' } | ForEach-Object {
Write-Host " [!] Metabase container detected: $_" -ForegroundColor Yellow
$Results += [PSCustomObject]@{ Check='CVE-2026-72898'; Target=$env:COMPUTERNAME; Detail="Docker: $_"; Status='VERIFY VERSION / PULL PATCHED IMAGE' }
}
}
# Network scan: probe Metabase default port 3000 and query version endpoint
$Subnets = @('192.168.1', '10.0.0') # <-- Customize for your environment
foreach ($Subnet in $Subnets) {
1..254 | ForEach-Object -Parallel {
$IP = "$using:Subnet.$_"
if (Test-Connection -ComputerName $IP -Count 1 -Quiet -TimeoutSeconds 1) {
try {
$Resp = Invoke-WebRequest -Uri "http://${IP}:3000/api/health" -TimeoutSec 3 -UseBasicParsing
if ($Resp.StatusCode -eq 200) {
$Props = Invoke-RestMethod -Uri "http://${IP}:3000/api/session/properties" -TimeoutSec 3
$Ver = $Props.version.tag
Write-Output "METABASE|$IP|$Ver"
}
} catch {}
}
} -ThrottleLimit 50 | ForEach-Object {
$Parts = $_ -split '\|'
Write-Host " [!] Metabase found at $($Parts[1]) version $($Parts[2])" -ForegroundColor Yellow
$script:Results += [PSCustomObject]@{ Check='CVE-2026-72898'; Target=$Parts[1]; Detail="Version $($Parts[2])"; Status='VERIFY AGAINST METABASE ADVISORY' }
}
}
Write-Host "`n[*] === CVE-2026-20349: Cisco ASA/FTD Management Interface Exposure ===" -ForegroundColor Cyan
# 5. Probe for Cisco ASDM/REST API interfaces (TCP 443 with Cisco fingerprints)
$CiscoTargets = @('10.0.0.1', '10.0.0.2') # <-- Replace with your firewall management IPs
foreach ($Target in $CiscoTargets) {
$Tcp = New-Object System.Net.Sockets.TcpClient
$Conn = $Tcp.BeginConnect($Target, 443, $null, $null)
if ($Conn.AsyncWaitHandle.WaitOne(2000) -and $Tcp.Connected) {
try {
$Req = Invoke-WebRequest -Uri "https://$Target/" -TimeoutSec 5 -UseBasicParsing -SkipCertificateCheck
if ($Req.Content -match 'ASDM|Cisco|Firepower') {
Write-Host " [!] Cisco management interface exposed at $Target - validate software train against Cisco advisory" -ForegroundColor Yellow
$Results += [PSCustomObject]@{ Check='CVE-2026-20349'; Target=$Target; Detail='ASDM/FTD mgmt reachable'; Status='VALIDATE PATCH LEVEL VIA CLI: show version' }
}
} catch {}
}
$Tcp.Close()
}
Write-Host "`n[*] === Report ===" -ForegroundColor Cyan
$Results | Export-Csv -Path $ReportPath -NoTypeInformation
$Results | Format-Table -AutoSize
Write-Host "`n[+] Inventory saved to $ReportPath"
Write-Host "[*] Next steps: (1) Deploy August 2026 Windows CU, (2) Upgrade Metabase per advisory, (3) Patch ASA/FTD per Cisco advisory or isolate mgmt interfaces."
Patch & Remediation Priorities
Priority 1 — CVE-2026-20349 (Cisco ASA/FTD) — IMMEDIATE
Edge device, confirmed exploitation, nation-state-grade target profile.
- Action: Apply the fixed software release per Cisco's security advisory for this CVE (check the Cisco Security Advisories portal). Verify current train with
show versionon every ASA/FTD device, including failover units. - Workaround if patching is delayed: Restrict management interface (ASDM/REST) access to a dedicated management VRF/bastion only; disable any internet-facing management; increase log forwarding and monitor for the behaviors in the Sigma rule above. Cisco advisories frequently include Snort rules for inspection-path mitigations — deploy them.
Priority 2 — CVE-2026-72898 (Metabase) — IMMEDIATE for internet-exposed, 72 hours otherwise
Unauthenticated remote exploitation; fastest mass-exploitation risk.
- Action: Upgrade to the patched Metabase release per the Metabase security advisory (check GitHub releases and Metabase's security announcement). Docker deployments: pull the patched image tag and redeploy.
- Workaround: Place Metabase behind authentication-enforcing reverse proxy or VPN; block internet exposure entirely; restrict the Metabase database account to least-privilege (read-only on analytics schemas) to limit SQLi blast radius.
Priority 3 — CVE-2026-68820 (Windows afd.sys) — Within CISA deadline, fleet-wide
Post-compromise EoP; patch kills the escalation leg of intrusion chains.
- Action: Deploy the August 2026 (or later) cumulative update per the Microsoft Security Update Guide. Prioritize servers, jump hosts, and endpoints in high-risk user populations (finance, executives, helpdesk) first.
- Workaround: None meaningful for a kernel driver bug — patching is the only effective remediation. Compensating controls: enforce Credential Guard, LSA protection, and EDR in block mode to disrupt post-exploitation chains that would use this EoP.
CISA Compliance
Federal civilian agencies must remediate all three CVEs by the due dates listed against each entry in the CISA KEV catalog under BOD 22-01. All other organizations should adopt the same deadlines as internal SLAs — KEV-listed CVEs are, by definition, being used against targets right now.
Analyst's Note
This batch is a complete intrusion kit: an edge device for initial access and persistence (Cisco), an application-layer unauthenticated entry point (Metabase), and a kernel EoP for the privilege escalation leg (Windows). Ransomware affiliates and their initial-access brokers do not think in individual CVEs — they chain exactly these layers. Patch in the order above, hunt with the detections provided, and assume breach posture on any device that was exposed before patching.
Related Resources
Security Arsenal Penetration Testing Managed SOC & MDR AlertMonitor Platform From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.