CVE-2026-20349 and the April 2026 CISA KEV Additions: Cisco Secure Firewall, Metabase, and Windows Flaws — Detection and Remediation Guide

---
title: Cisco ASA FTD Suspicious Web Interface Request Patterns
id: 3f8a2c71-9d4e-4b6a-a512-8c7e5f1d9a02
status: experimental
description: Detects anomalous HTTP request patterns against Cisco ASA/FTD web services (WebVPN, ASDM) consistent with unauthenticated exploitation attempts such as path traversal, abnormal POST bodies, or access to non-standard endpoints. Tune the path list to your environment's actual published portals.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  product: cisco
  service: asa
detection:
  selection_uri:
    csuri|contains:
      - '/+CSCOE+/'
      - '/+CSCOT+/'
      - '/remote/'
      - '/.git'
      - '%2e%2e'
      - '..%2f'
      - '/../'
  selection_suspicious_post:
    csmethod: 'POST'
    csuri|contains:
      - '/admin/'
      - '/exec/'
      - '/+CSCOE+/files/'
  condition: selection_uri or selection_suspicious_post
falsepositives:
  - Legitimate AnyConnect/WebVPN session establishment on published portals
  - Vulnerability scanners and authorized penetration tests
level: high
---
title: Metabase Java Process Spawning Command Shell
id: 6b1d9e44-2f7a-4c83-b905-4e2a7d3c1f58
status: experimental
description: Detects the Metabase Java runtime spawning shell or scripting interpreters, a strong post-exploitation indicator for RCE against the Metabase application. Legitimate Metabase operation does not spawn cmd.exe, powershell.exe, sh, or bash as child processes.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - 'java.exe'
      - '/java'
      - '/bin/java'
  selection_parent_cmd:
    ParentCommandLine|contains: 'metabase'
  selection_child:
    Image|endswith:
      - 'cmd.exe'
      - 'powershell.exe'
      - 'pwsh.exe'
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/curl'
      - '/usr/bin/wget'
      - '/usr/bin/python'
      - '/usr/bin/python3'
  condition: selection_parent and selection_parent_cmd and selection_child
falsepositives:
  - Rare: custom Metabase plugins or admin automation wrapping the JVM
level: critical
---
title: Web Server or JVM Worker Spawning Suspicious System Tools
id: 9c4e7b12-5a83-4f6d-9218-3b7c6e0a2d41
status: experimental
description: Detects common post-exploitation behavior following perimeter appliance or web application compromise, where the attacker executes reconnaissance and credential theft tooling via a spawned shell. Complements the Metabase-specific rule for environments where the exploited service identity is unknown.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.discovery
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - 'w3wp.exe'
      - 'java.exe'
      - 'tomcat9.exe'
      - 'nginx.exe'
      - 'httpd.exe'
  selection_cmd:
    CommandLine|contains:
      - 'whoami'
      - 'ipconfig /all'
      - 'net user'
      - 'net localgroup administrators'
      - 'systeminfo'
      - 'quser'
      - 'nltest'
      - 'tasklist'
  condition: selection_parent and selection_cmd
falsepositives:
  - Application health-check scripts (rare on production web tiers)
  - MSP/RMM tooling misconfigured to run under the web service context
level: high

// Hunt: Suspicious request patterns against Cisco ASA/FTD web services (via CEF/Syslog ingestion)
// Look for traversal sequences, non-standard endpoints, and POSTs to management paths
let timerange = 14d;
CommonSecurityLog
| where TimeGenerated > ago(timerange)
| where DeviceVendor =~ "Cisco"
| where DeviceProduct has_any ("ASA", "FTD", "Firepower")
| where RequestURL has_any ("%2e%2e", "..%2f", "/../", "/+CSCOE+/", "/+CSCOT+/", "/remote/", "/.git")
    or (RequestMethod =~ "POST" and RequestURL has_any ("/admin/", "/exec/", "/+CSCOE+/files/"))
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestMethod, RequestURL,
          SourceUserName, DeviceAction, Message
| order by TimeGenerated desc;
// Hunt: Java/Metabase spawning shells across Windows and Linux endpoints (Defender + Syslog)
let timerange2 = 14d;
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated > ago(timerange2)
| where InitiatingProcessFileName =~ "java.exe" or InitiatingProcessCommandLine has "metabase"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","sh","bash","curl","wget","python","python3")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName),
(Syslog
| where TimeGenerated > ago(timerange2)
| where SyslogMessage has_all ("java", "metabase")
    and SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl ", "wget ")
| project TimeGenerated, Computer, ProcessName, SyslogMessage)
| order by TimeGenerated desc;

-- Hunt for post-exploitation artifacts on Metabase hosts:
-- JVM-spawned shells, dropped web shells/scripts in Metabase dirs, and unexpected listeners
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)java' OR CommandLine =~ '(?i)metabase')
   OR CommandLine =~ '(?i)(/bin/sh|/bin/bash|cmd\.exe|powershell)'
ORDER BY CreateTime DESC

-- Correlate with listening sockets owned by java processes (potential reverse shells/persistence)
SELECT Pid, Name, CommandLine, 'LISTENER' AS Context
FROM netstat()
WHERE Status =~ 'LISTEN' AND Name =~ '(?i)java'

-- Look for recently modified files in Metabase deployment directories (dropped tooling)
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=['/opt/metabase/**/*', '/usr/share/metabase/**/*', 'C:/Program Files/Metabase/**/*'])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

#!/bin/bash
# CVE-2026-20349 / April 2026 KEV batch - exposure verification script
# Run from a management host with SSH access to ASA/FTD and access to Metabase servers.
# 1) Check ASA/FTD software version (compare against Cisco advisory fixed releases)
ASA_HOST="$1"
if [ -n "$ASA_HOST" ]; then
  echo "=== ASA/FTD version check on $ASA_HOST ==="
  ssh -o ConnectTimeout=10 admin@"$ASA_HOST" "show version | include Cisco Adaptive|Firepower|Software"
  echo "[!] Compare output against fixed versions in Cisco's advisory for CVE-2026-20349."
  echo "=== Recent config changes (potential tampering) ==="
  ssh admin@"$ASA_HOST" "show startup-config errors; show running-config | include username|ssh|http server"
fi
# 2) Check local Metabase version (jar deployment)
echo "=== Metabase version check ==="
if [ -f /opt/metabase/metabase.jar ]; then
  java -jar /opt/metabase/metabase.jar version 2>/dev/null || echo "[!] Unable to query version - check service manually"
else
  echo "[!] metabase.jar not found at /opt/metabase - adjust path for your deployment"
fi
# 3) Flag internet exposure of Metabase (should never be public without auth gateway)
echo "=== Listening interfaces for Metabase port 3000 ==="
ss -tlnp 2>/dev/null | grep ':3000' && echo "[!] If bound to 0.0.0.0, verify it is NOT reachable from the internet"