# U.S. CISA Flags Critical Vulnerabilities in Metabase, Windows, and Cisco Firewalls Federal agencies must patch these security flaws by August 2026 to prevent system breaches. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-08-13 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/143effb2-b307-4b04-913e-13179778713a ## CISA's Urgent Advisory The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added critical vulnerabilities in Metabase, Windows, and Cisco firewalls to its Known Exploited Vulnerabilities catalog. CVE-2026-20349 (CVSS 8.6) causes remote service disruption in Cisco ASA/FTD, while CVE-2026-72898 (CVSS 10.0) allows SQL injection in Metabase. Federal agencies are mandated to patch these flaws by specified deadlines. ## Cisco Firewall Vulnerability CVE-2026-20349 stems from insufficient error checking in HTTP request processing within Cisco Secure Firewall. Attackers can craft specialized SSL VPN requests to crash devices and disrupt network access. This vulnerability forcing firewall reboots poses significant outage risks for enterprise networks. ## Windows Kernel-Level Threat CVE-2026-68820 (CVSS 7.0) is a use-after-free flaw in afd.sys, the kernel-mode driver for Windows Sockets API. Microsoft confirms active exploitation, allowing attackers SYSTEM-level code execution. Despite CVSS listing exploit maturity as 'Unproven', immediate patching is critical. ## Metabase Data Breach Risk CVE-2026-72898 enables unauthenticated SQL injection directly into Metabase application databases. The company disclosed attacks exploiting this 0-day in Metabase Cloud v1.58+. While cloud instances auto-remediated, self-hosted deployments require urgent manual patching. ## Business Intelligence Domino Effect Tools like Metabase typically connect to organizations' most sensitive data warehouses. This vulnerability allows attackers to steal credentials for all connected databases, modify configurations, and exfiltrate data. Industry experts describe this as 'worst-case blast radius' for BI platforms. ## Cloud vs On-Premise Impact Metabase Cloud users received automatic patches before most were aware of the issue. However, on-premise deployments face different risk profiles, requiring immediate updates by IT teams and thorough breach investigations where applicable. ## Federal Compliance Deadlines Per Binding Operational Directive (BOD) 22-01, federal agencies must patch CVE-2026-20349 and CVE-2026-72898 by August 14, 2026, and CVE-2026-68820 by August 25, 2026. CISA also urges private sector organizations to review and address catalog vulnerabilities. ## Cross-Industry Implications These vulnerabilities particularly impact finance, healthcare, and government sectors. The widespread use of Cisco/Microsoft products and Metabase's popularity in data analytics creates broad exposure. Experts recommend all organizations update their threat models, not just federal entities. ## Sources covering this story - https://securityaffairs.com/197110/uncategorized/u-s-cisa-adds-metabase-windows-and-cisco-secure-firewall-flaws-to-its-known-exploited-vulnerabilities-catalog.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._