A quiet KEV update this week is a reminder: patching is an ongoing process, not a one-time task. Here’s a practical, easy-to-follow look at three actively exploited vulnerabilities now in the Known Exploited Vulnerabilities catalog, and what you can do to stay safer.
What happened
On August 11–13, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The affected products are Cisco Secure Firewall ASA/FTD, Microsoft Windows, and Metabase. The KEV catalog flags active exploitation and prioritizes remediation so organizations can act quickly.
- CVE-2026-20349 Cisco Secure Firewall ASA/FTD Heap Inspection vulnerability. An unauthenticated attacker could trigger a device reload by sending crafted HTTP requests, potentially causing a denial-of-service condition.
- CVE-2026-68820 Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free vulnerability. Exploitation could cause stability issues and may lead to remote impact on affected systems.
- CVE-2026-72898 Metabase SQL Injection vulnerability. An unauthenticated remote attacker could inject SQL, potentially gaining administrative access to the Metabase instance.
Why it matters
These fixes matter for different readers in clear ways:
- Regular users: If you’re running any of these products at home (rare, but possible with small setups), updates ensure you’re not exposed to known bad behavior that attackers can already exploit in the wild.
- Small businesses: These three vulnerabilities target common security gear and data tools. Patching quickly reduces the risk of a remote attacker taking down a firewall, crashing a server, or taking control of a business analytics tool.
- Creators and IT-minded readers: If you host Metabase for dashboards or rely on Windows servers, this KEV listing is a reminder to review your patch management cadence and to validate your backups and monitoring before applying updates.
Practical steps you can take now
- Inventory and identify exposure: Make a quick pass over your assets to see if you run Cisco Secure Firewall ASA/FTD, Windows servers/clients, or Metabase deployments. Create a short list of who relies on these products in your environment.
- Patch promptly: Apply vendor-supplied updates for Cisco Secure Firewall ASA/FTD, Windows, and Metabase as soon as they’re available. If a patch isn’t yet released for a product you use, check for official mitigations or workarounds from the vendor or KEV guidance.
- Implement mitigations if patches aren’t ready: Where patches aren’t available yet, consider compensating controls such as disabling exposed admin interfaces, restricting access to management consoles, implementing network segmentation, and adding additional firewall or WAF protections around vulnerable endpoints.
- Strengthen vulnerability management: Ensure your asset inventory is up to date, run a vulnerability scan against these products, and verify patch deployment in a test and then production environment.
- Improve monitoring and backups: Enable anomaly detection around management interfaces, monitor for unusual query activity in Metabase, and confirm that recent backups are intact and retrievable in case a restore is needed after an exploit.
- Plan a quick follow-up: Schedule a 1–2 week patch review to re-check for any newly published mitigations or newer KEV entries related to these products.
Final thought
Staying ahead of exploits isn’t about chasing every alert, it’s about making a steady, repeatable patching and monitoring habit. Start with the obvious, then build a simple vulnerability-management routine that fits your environment. If you’d like, I can help outline a small, repeatable patch cadence for your setup or walk you through a test patch in a safe environment.