Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

CISA Flags Critical Flaws in Metabase, Windows and Cisco Firewall

Part of the CVE-2026-20349 story · since 11 Aug

Quiet for 2 weekslast report 29 Oct8 articles4 outlets
11 Aug · CISA first12 Sep28 Sep14 Oct30 OctNowThis article6th of 8
  • Tue 11 Aug, 22:35 UTC. CISA, first report. Cisco ASA/FTD heap bug lets remote attackers crash firewalls. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:17 UTC. CISA. CISA adds Cisco firewall heap flaw CVE-2026-20349 to KEV catalog. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 02:32 UTC. SecurityOnline, its first report on the story. Cisco ASA/FTD flaw lets attackers crash firewalls, CVE-2026-20349. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 05:20 UTC. SecurityWeek, its first report on the story. Cisco patches critical ASA/FTD zero day as attacks spike. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 13:32 UTC. SecurityOnline. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed. Cites a CVE in CISA KEV.
  • Thu 13 Aug, 17:21 UTC. Security Affairs, its first report on the story. CISA Flags Critical Flaws in Metabase, Windows and Cisco Firewall. Cites a CVE in CISA KEV. This article, 6th of 8.
  • Mon 17 Aug, 02:40 UTC. SecurityOnline. Critical Metabase SQLi flaw lets attackers seize full admin control. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 10:30 UTC. SecurityWeek. Cisco fixes exploited VPN flaw that can crash firewalls. Cites a CVE in CISA KEV.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added vulnerabilities related to Metabase, Windows, and Cisco Secure Firewall to its Known Exploited Vulnerabilities catalog. The vulnerabilities include:

1. **CVE-2026-20349**: A heap inspection vulnerability in Cisco Secure Firewall that could allow remote attackers to cause a denial-of-service condition (CVSS score: 8.6).

2. **CVE-2026-68820**: A use-after-free flaw in Windows that can enable code execution with SYSTEM-level privileges (CVSS score: 7.0), which is currently under active exploitation.

3. **CVE-2026-72898**: An SQL injection vulnerability in Metabase that allows attackers to inject SQL commands into the application database (CVSS score: 10.0).

CISA requires federal agencies to address these issues by specific deadlines, with an emphasis on timely patching to protect against potential attacks. Organizations are advised to check the CISA catalog for compliance.

How the story developed

All 8 articles
Quiet for 2 weekslast report 29 Oct8 articles4 outlets

8 articles from 4 outlets since 11 Aug. Quiet since 29 Oct. This was the 6th report, 2 days after the first.

Now11 Aug151729 Oct246810First reportCISA · 11 Aug, 22:35This article6th of 8 · day 2
  • Tue 11 Aug, 22:35 UTC. CISA, first report. Cisco ASA/FTD heap bug lets remote attackers crash firewalls. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:17 UTC. CISA. CISA adds Cisco firewall heap flaw CVE-2026-20349 to KEV catalog. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 02:32 UTC. SecurityOnline, its first report on the story. Cisco ASA/FTD flaw lets attackers crash firewalls, CVE-2026-20349. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 05:20 UTC. SecurityWeek, its first report on the story. Cisco patches critical ASA/FTD zero day as attacks spike. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 13:32 UTC. SecurityOnline. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed. Cites a CVE in CISA KEV.
  • Thu 13 Aug, 17:21 UTC. Security Affairs, its first report on the story. CISA Flags Critical Flaws in Metabase, Windows and Cisco Firewall. Cites a CVE in CISA KEV. This article, 6th of 8.
  • Mon 17 Aug, 02:40 UTC. SecurityOnline. Critical Metabase SQLi flaw lets attackers seize full admin control. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 10:30 UTC. SecurityWeek. Cisco fixes exploited VPN flaw that can crash firewalls. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 8 articles as a list
  1. Tue 11 AugDay 01
    1. Cisco ASA/FTD heap bug lets remote attackers crash firewalls22:35 · CISA · official · First report · CISA alert · Known exploited CVE
  2. Wed 12 AugDay 14
    1. CISA adds Cisco firewall heap flaw CVE-2026-20349 to KEV catalog00:17 · CISA · official · Known exploited CVE
    2. Cisco ASA/FTD flaw lets attackers crash firewalls, CVE-2026-2034902:32 · SecurityOnline · Known exploited CVE
    3. Cisco patches critical ASA/FTD zero day as attacks spike05:20 · SecurityWeek · Known exploited CVE
    4. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed13:32 · SecurityOnline · Known exploited CVE
  3. Thu 13 AugDay 21
    1. CISA Flags Critical Flaws in Metabase, Windows and Cisco Firewall17:21 · Security Affairs · Known exploited CVE · This article, 6th of 8

  4. Quiet for 3 days

    Mon 17 AugDay 61
    1. Critical Metabase SQLi flaw lets attackers seize full admin control02:40 · SecurityOnline · Picked up again · Known exploited CVE

  5. Quiet for 10 weeks

    Thu 29 OctDay 791
    1. Cisco fixes exploited VPN flaw that can crash firewalls10:30 · SecurityWeek · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in