CISA added three vulnerabilities to the Known Exploited Vulnerabilities catalogue on 11 August 2026. The CVEs got coverage. The deadlines did not, and they are the more interesting half.
| CVE | Product | Due date | Window |
|---|---|---|---|
| CVE-2026-20349 | Cisco Secure Firewall ASA / FTD | 14 Aug 2026 | 3 days |
| CVE-2026-72898 | Metabase | 14 Aug 2026 | 3 days |
| CVE-2026-68820 | Windows AFD for WinSock | 25 Aug 2026 | 14 days |
Binding Operational Directive 22-01 normally gives agencies weeks. A three-day window is what CISA issues when it believes the exposure is being actively worked through faster than a normal patch cycle can absorb — and it applied that to two of the three on the same day.
What each one actually is
Worth reading CISA's own descriptions rather than the summaries, because at least one is routinely overstated elsewhere.
CVE-2026-20349 — Cisco Secure Firewall ASA and FTD. CISA calls this a heap inspection vulnerability that
could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
Note what that says and does not say. This is denial of service, not remote code execution. If you have seen it described as RCE, that is wrong. It is still serious — unauthenticated, remote, and against the box that terminates your VPN — but the impact is availability, and knowing that changes how you rank it against everything else in your queue.
CVE-2026-72898 — Metabase. This is the one that deserved more attention than it got:
Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance.
Unauthenticated, remote, straight to administrator. Metabase is a business-intelligence front end, which means the instance is typically wired into the warehouse and holds saved credentials for everything it reports on. Administrator access to Metabase is rarely the objective — it is the pivot.
CVE-2026-68820 — Windows AFD for WinSock. A use-after-free allowing local privilege escalation, covered separately.
The pattern worth noticing
Two of these three are internet-facing infrastructure that organisations forget is software: a firewall appliance and a self-hosted analytics tool. Neither sits in a normal OS patch cycle. Both got the compressed deadline.
That is the recurring shape of KEV additions — not the desktop and server estate that already has a monthly rhythm, but the appliances and the internal tools somebody stood up once and stopped thinking about.
If you want an honest answer to "would we have caught these," the test is not whether you patch Windows. It is whether anyone owns the Cisco firmware version and the Metabase container tag, and whether either would have been noticed inside 72 hours.
Source
Verify against the KEV catalogue directly. Every quotation above is CISA's own wording, taken from the catalogue feed on the date of publication.