CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog

On August 11, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. The additions include:

- CVE-2026-20349: A heap inspection vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD).
- CVE-2026-68820: A use-after-free vulnerability in the Microsoft Windows Ancillary Function Driver for WinSock.
- CVE-2026-72898: A SQL injection vulnerability in Metabase.

These vulnerabilities are considered frequent attack vectors for malicious cyber actors and pose significant risks to federal enterprise and internet-facing systems. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies must prioritize rapid remediation of KEV-listed vulnerabilities, especially those on publicly exposed assets that could grant total control post-exploitation. The directive also requires agencies to check for signs of compromise before applying patches.

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities that meet the specified criteria, and organizations can nominate additional exploited vulnerabilities via the KEV Nomination Form, provided they have a CVE ID, evidence of exploitation, and clear mitigation guidance.

Specific technical details, threat actor attribution, and patch versions were not disclosed in the advisory. Organizations should consult vendor advisories from Cisco, Microsoft, and Metabase for mitigation and patch information.