U.S. CISA Flags Critical Vulnerabilities in Metabase, Windows, and Cisco Firewalls
Federal agencies must patch these security flaws by August 2026 to prevent system breaches.
1CISA's Urgent Advisory
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added critical vulnerabilities in Metabase, Windows, and Cisco firewalls to its Known Exploited Vulnerabilities catalog. CVE-2026-20349 (CVSS 8.6) causes remote service disruption in Cisco ASA/FTD, while CVE-2026-72898 (CVSS 10.0) allows SQL injection in Metabase. Federal agencies are mandated to patch these flaws by specified deadlines.
2Cisco Firewall Vulnerability
CVE-2026-20349 stems from insufficient error checking in HTTP request processing within Cisco Secure Firewall. Attackers can craft specialized SSL VPN requests to crash devices and disrupt network access. This vulnerability forcing firewall reboots poses significant outage risks for enterprise networks.
3Windows Kernel-Level Threat
CVE-2026-68820 (CVSS 7.0) is a use-after-free flaw in afd.sys, the kernel-mode driver for Windows Sockets API. Microsoft confirms active exploitation, allowing attackers SYSTEM-level code execution. Despite CVSS listing exploit maturity as 'Unproven', immediate patching is critical.
4Metabase Data Breach Risk
CVE-2026-72898 enables unauthenticated SQL injection directly into Metabase application databases. The company disclosed attacks exploiting this 0-day in Metabase Cloud v1.58+. While cloud instances auto-remediated, self-hosted deployments require urgent manual patching.
5Business Intelligence Domino Effect
Tools like Metabase typically connect to organizations' most sensitive data warehouses. This vulnerability allows attackers to steal credentials for all connected databases, modify configurations, and exfiltrate data. Industry experts describe this as 'worst-case blast radius' for BI platforms.
6Cloud vs On-Premise Impact
Metabase Cloud users received automatic patches before most were aware of the issue. However, on-premise deployments face different risk profiles, requiring immediate updates by IT teams and thorough breach investigations where applicable.
7Federal Compliance Deadlines
Per Binding Operational Directive (BOD) 22-01, federal agencies must patch CVE-2026-20349 and CVE-2026-72898 by August 14, 2026, and CVE-2026-68820 by August 25, 2026. CISA also urges private sector organizations to review and address catalog vulnerabilities.
8Cross-Industry Implications
These vulnerabilities particularly impact finance, healthcare, and government sectors. The widespread use of Cisco/Microsoft products and Metabase's popularity in data analytics creates broad exposure. Experts recommend all organizations update their threat models, not just federal entities.
Original article: Security Affairs — ABD Siber Güvenlik Ajansı Kritik Açıkları Listesine Ekledi