Skip to content
eastbaycyber
CISA KEV additions

CISA Adds 3 Known Exploited Vulnerabilities to Catalog (August 11, 2026)

Source: CISA KEV Catalog · Updated 2026-09-25

Summary

On August 11, 2026, CISA added 3 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-20349, CVE-2026-68820, CVE-2026-72898. A KEV listing means CISA has evidence of active exploitation. CISA sets a remediation due date for US federal civilian agencies under its binding operational directives; any organization running the affected products should treat these as patch-now priorities.

CVE-2026-20349: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

Cisco · Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

Federal due date
2026-08-14
Ransomware use
Unknown
Added
2026-08-11

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record · Cisco KEV history

CVE-2026-68820: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Microsoft · Windows Ancillary Function Driver for WinSock

Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

Federal due date
2026-08-25
Ransomware use
Unknown
Added
2026-08-11

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record · Microsoft KEV history

CVE-2026-72898: Metabase SQL Injection Vulnerability

Metabase · Metabase

Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.

Federal due date
2026-08-14
Ransomware use
Unknown
Added
2026-08-11

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record

Also added to KEV in August 2026

  • August 31, 2026: CVE-2026-82078, PaperCut NG/MF (PaperCut NG/MF Unsafe Reflection Vulnerability)
  • August 31, 2026: CVE-2026-81578, PaperCut NG/MF (PaperCut NG/MF Missing Authentication for Critical Function Vulnerability)
  • August 27, 2026: CVE-2026-66384, JFrog Artifactory (JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vu)
  • August 27, 2026: CVE-2026-53362, Linux Kernel (Linux Kernel Unspecified Vulnerability)
  • August 27, 2026: CVE-2023-49105, ownCloud ownCloud (ownCloud Improper Authentication Vulnerability)
  • August 26, 2026: CVE-2026-8452, Citrix NetScaler ADC and NetScaler Gateway (Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations wi)
  • August 26, 2026: CVE-2022-0995, Linux Kernel (Linux Kernel Out-of-Bounds Write Vulnerability)
  • August 26, 2026: CVE-2021-23758, Ajax.NET Professional Ajax.NET Professional (Ajax.NET Professional Deserialization of Untrusted Data Vulnerability)
  • August 26, 2026: CVE-2019-1068, Microsoft SQL Server (Microsoft SQL Server Remote Code Execution Vulnerability)
  • August 26, 2026: CVE-2015-5287, Red Hat Automatic Bug Reporting Tool (Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability)
  • August 26, 2026: CVE-2015-3246, Red Hat Libuser (Red Hat Libuser Race Condition Vulnerability)
  • August 25, 2026: CVE-2026-60004, Gitea Gitea (Gitea Code Injection Vulnerability)
  • August 24, 2026: CVE-2026-21962, Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in (Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Cont)
  • August 21, 2026: CVE-2026-73570, Synacor Zimbra Collaboration Suite (ZCS) (Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability)
  • August 20, 2026: CVE-2026-72530, TrueConf Server (TrueConf Server Code Injection Vulnerability)
  • August 20, 2026: CVE-2026-72529, TrueConf Server (TrueConf Server Missing Authentication for Critical Function Vulnerability)
  • August 19, 2026: CVE-2026-64849, MLflow MLflow (MLflow Server-Side Request Forgery Vulnerability)
  • August 18, 2026: CVE-2026-65400, Apple macOS (Apple macOS Improper Authentication Vulnerability)
  • August 18, 2026: CVE-2026-59310, Broadcom VMware vCenter (Broadcom VMware vCenter Path Traversal Vulnerability)
  • August 18, 2026: CVE-2026-55040, Microsoft SharePoint (Microsoft SharePoint Weak Authentication Vulnerability)
  • August 18, 2026: CVE-2026-33824, Microsoft Internet Key Exchange (IKE) Service Extensions (Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerabili)
  • August 17, 2026: CVE-2025-62593, Ray-Project Ray (Ray-Project Ray Code Injection Vulnerability)
  • August 7, 2026: CVE-2026-8037, Progress LoadMaster (Progress LoadMaster Command Injection Vulnerability)
  • August 5, 2026: CVE-2026-63077, JetBrains TeamCity (JetBrains TeamCity Deserialization of Untrusted Data Vulnerability)
  • August 4, 2026: CVE-2026-9198, IBM Langflow (IBM Langflow Code Injection Vulnerability)

Check whether you run these products: our vulnerability scanner comparison covers tools that detect KEV-listed flaws. See also the KEV dashboard and KEV history by vendor.