CISA added three new entries to its Known Exploited Vulnerabilities (KEV) catalog this week: CVE-2026-20349 (Cisco ASA and FTD Heap Inspection DoS), CVE-2026-68820 (Microsoft Windows WinSock AFD.sys Use-After-Free LPE), and CVE-2026-72898 (Metabase Unauthenticated SQL Injection Admin Takeover). These additions emphasize continued adversary focus on perimeter SSL VPN gateways, active kernel-level privilege escalation zero-days utilized by nation-state actors, and unauthenticated zero-day takeovers of business intelligence software holding stored data warehouse credentials. Security operations and infrastructure teams should prioritize immediate validation, emergency patching, and log hunting across these assets.

Reading time 10 minutes

Audience: Vulnerability Managers, Security Operations, CISOs, DevSecOps Teams
Reading Time: Approximately 10 minutes

This Week's KEV Additions

Analysis

CVE-2026-20349 — Cisco / Adaptive Security Appliance (ASA) & Secure Firewall Threat Defense (FTD)

What it is:

A vulnerability in the Remote Access SSL VPN service of Cisco ASA and FTD software caused by insufficient error checking during HTTP request processing, allowing an unauthenticated remote attacker to trigger a heap memory error and cause the device to crash and reload unexpectedly.

Affected versions:

Cisco ASA Software and Cisco FTD Software configured with Remote Access SSL VPN services enabled.

Exploitation status:

Active in the wild (CISA KEV added August 11, 2026). Public exploit code and active scanning against internet-exposed SSL VPN management interfaces have been confirmed.

Patch available:

Yes — Software updates and fixed releases have been published via the Cisco Security Advisory portal.

CISA due date:

2026-08-14.

Operational risk:

An unauthenticated attacker can continuously crash perimeter security gateways by sending malformed HTTP requests to the Remote Access SSL VPN interface. This causes sustained Denial of Service (DoS), tears down active VPN tunnels, and disrupts secure remote access across corporate infrastructure.

CVE-2026-68820 — Microsoft / Windows Ancillary Function Driver for WinSock (AFD.sys)

What it is:

A use-after-free vulnerability in the kernel-mode driver AFD.sys (Ancillary Function Driver for WinSock) caused by improper synchronization when handling socket state objects across multi-threaded operations.

Affected versions:

Windows 10, Windows 11, and Windows Server builds prior to the August 2026 Patch Tuesday updates.

Exploitation status:

Actively exploited in the wild as a zero-day prior to public disclosure. Threat intelligence reports attribute active targeting to nation-state activity (e.g., Lazarus Group deploying the FudModule rootkit).

Patch available:

Yes — Resolved in Microsoft’s August 2026 cumulative security updates.

CISA due date:

2026-08-14.

Operational risk:

A locally authenticated attacker with low privileges can execute a specially crafted application to trigger a race condition, manipulate memory, and elevate rights directly to NT AUTHORITY\SYSTEM without user interaction. This acts as a secondary execution stage following initial access to disable local EDR protections and establish kernel rootkits.

CVE-2026-72898 — Metabase / Metabase Open Source & Enterprise

What it is:

An unauthenticated SQL injection vulnerability in the password reset API endpoint (POST /api/session/reset_password) resulting from improper parameter handling in the Clojure query-builder component.

Affected versions:

Metabase Open Source and Enterprise versions 0.58.0 through 0.63.4 (e.g., Enterprise 1.58.0 through 1.63.4). Fixed in versions 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5 (and corresponding 1.x Enterprise releases). Metabase Cloud instances were patched automatically prior to advisory release.

Exploitation status:

Actively exploited in the wild as a zero-day against cloud and self-hosted instances prior to public disclosure.

Patch available:

Yes — Official maintenance releases have been provided across all supported version branches.

CISA due date:

2026-08-14.

Operational risk:

Allows an unauthenticated remote attacker to inject arbitrary SQL statements into the internal Metabase application database. Adversaries leverage this to override administrative passwords, hijack accounts, and exfiltrate stored database connection strings and credentials for connected corporate data warehouses.

Exploitation Context

This week's CISA KEV additions demonstrate a clear focus on initial edge disruption, local privilege persistence, and backend data warehouse compromise:

1. Perimeter VPN Gateway Denial: Active scanning against Cisco ASA and FTD Remote Access SSL VPN interfaces allows attackers to destabilize security perimeters.

2. Kernel Rootkit Elevation: Microsoft’s AFD.sys zero-day (CVE-2026-68820) shows state-sponsored actors actively utilizing use-after-free flaws to achieve kernel-level persistence and blind host detection tools.

3. Data Analytics Pipeline Access: Zero-day exploitation of Metabase (CVE-2026-72898) targets business intelligence platforms to extract stored credentials for production databases and data lakes.

Remediation Priorities

Detection and Monitoring Guidance

Relevant Log Sources:

- Cisco ASA/FTD Syslog messages (%ASA-4-710005 or system crash dump logs).

- Windows System Event Logs (System.evtx), EDR kernel object creation telemetry, and process execution logs for AFD.sys thread interactions.

- Metabase Web Server / Ingress Access Logs and application logs.

Event IDs / Command Verification:

- Inspect Metabase server access logs for the documented attack signature sequence:

- POST /api/session/reset_password returning HTTP 400 followed immediately by GET /api/user/current returning HTTP 200.

Behavioral Indicators:

- Unexpected process spawning under web service accounts following Metabase reset endpoint interactions.

- Unexplained reboot cycles or core dumps on Cisco ASA/FTD units processing external HTTP requests on SSL VPN listener ports.

- Local low-privileged processes making rapid concurrent socket creation calls in Windows (AFD.sys), followed by token manipulation or kernel-mode driver load events.

Threat Hunting Starting Points:

- Query SIEM logs for unusual administrative logins or new user account creations in Metabase immediately following HTTP 400 responses on password reset endpoints.

- Check Windows event logs for suspicious service creation or driver load events linked to kernel manipulation post-exploitation.

Monitoring Gap Note:

Because CVE-2026-72898 manipulates input fields within legitimate HTTP POST requests, network signatures looking only for standard SQL key phrases may miss encoded payloads. Defenders must rely on web application log sequence analysis (400 status followed by 200 on /api/user/current).

Hackerstorm Analysis

This week’s updates reflect a dangerous combination of initial access strategies. While perimeter devices like Cisco ASA/FTD are targeted with DoS conditions to destabilize operations, adversaries are aggressively exploiting logic flaws in business platforms like Metabase to acquire stored cloud and data warehouse credentials directly. Concurrently, local zero-days in core Windows drivers like AFD.sys ensure that once inside, threat actors can smoothly escalate to SYSTEM privileges, bypass EDR controls, and deploy persistent rootkits. Security teams must move beyond isolated vulnerability patching to enforce strict network segmentation around analytics platforms and maintain zero-trust boundaries for kernel-level driver interactions.

What you should do next

Ensure you understand the latest KEV additions to cover off any potential gaps in your remediation activities. View all weekly reports here

Further Reading

🔗 Exposure-Based Vulnerability Prioritization: EPSS, KEV & Risk
Why read this: Integrate EPSS scoring with KEV intelligence for exposure-driven remediation decisions.
https://www.hackerstorm.com/articles/our-blog/vulnerability-intelligence-analysis/vulnerability-management-operational-risk-exposure-prioritization

🔗 CVE Overload: Why Most Patch Programs Fail
Why read this: Identify systemic vulnerabilities in traditional patching workflows.
https://www.hackerstorm.com/articles/our-blog/vulnerabililty-intelligence/why-most-patch-programs-fail

🔗 CVSS vs EPSS: How to Prioritise Vulnerabilities by Real Exploitation Risk
Why read this: Replace static severity scoring with probability-based threat modeling.
https://www.hackerstorm.com/articles/our-blog/vulnerability-intelligence-analysis/cvss-vs-epss-vulnerability-prioritisation-exploitation-risk

About This Report

Attribution Note

This analysis is based on publicly available reporting and security research summaries. Some technical details may change as additional information becomes available. 

Author Information

Timur Mehmet | Founder & Lead Editor

Timur is a veteran Information Security professional with a career spanning over three decades. Since the 1990s, he has led security initiatives across high-stakes sectors, including Finance, Telecommunications, Media, and Energy. Professional qualifications over the years have included CISSP, ISO27000 Auditor, ITIL and technologies such as Networking, Operating Systems, PKI, Firewalls. For more information including independent citations and credentials, visit our About page.

Contact: This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Standards

This article adheres to Hackerstorm.com's commitment to accuracy, independence, and transparency:

• Fact-Checking: All statistics and claims are verified against primary sources and authoritative reports
• Source Transparency: Original research sources and citations are provided in the References section below
• No Conflicts of Interest: This analysis is independent and not sponsored by any vendor or organization
• Corrections Policy: We correct errors promptly and transparently. Report inaccuracies to This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Policy: Ethics, Non-Bias, Fact Checking and Corrections

Learn More: About Hackerstorm.com | FAQs

Source Transparency

CISA Known Exploited Vulnerabilities Catalog:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

NIST National Vulnerability Database (NVD):

https://nvd.nist.gov/

Cisco Security Advisory (cisco-sa-asaftd-vpn-dos-dzv4mQFF):
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF

Microsoft Security Response Center (MSRC) Advisory — CVE-2026-68820: 
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820

Metabase Security Advisory (GHSA-vwf4-m7j8-wcjf): 
https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf

Analyst Notes

• No ransomware attribution was publicly associated with this week's KEV additions at the time of publication.
• No confirmed threat actor attribution was available beyond CISA's confirmation of active exploitation for the majority of entries.
• Where vendor advisory details or EPSS values were unavailable at publication time, placeholders were retained pending analyst validation and vendor updates prior to final publication.