CISA Adds Critical Cisco ASA, Windows Winsock, and Metabase SQL Injection Flaws to KEV Catalog
What It Is — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has placed three high‑severity vulnerabilities into its Known Exploited Vulnerabilities (KEV) catalog:
- CVE‑2026‑20349 – Cisco Secure Firewall ASA/FTD heap‑inspection flaw (CVSS 8.6).
- CVE‑2026‑68820 – Microsoft Windows ancillary Winsock driver use‑after‑free (CVSS 7.0).
- CVE‑2026‑72898 – Metabase unauthenticated SQL‑injection (CVSS 10.0).
Exploitability — All three are reported as actively exploited in the wild. Cisco and Metabase attacks have been observed in production environments; Microsoft notes “unproven” exploit maturity but acknowledges active exploitation attempts.
Affected Products – Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD); Microsoft Windows kernel‑mode Winsock driver (afd.sys); Metabase 1.58+ (both self‑hosted and Metabase Cloud).
Why It Matters for Compliance & Audit Readiness
- Control Mapping: Each flaw maps to SOC 2 CC6.1 (System Operations) and CC7.1 (Change Management). Unpatched assets constitute a control deficiency that auditors will flag.
- Continuous Evidence: Demonstrating timely patching and remediation is essential evidence for a defensible SOC 2 audit trail.
- Enterprise Buyer Expectations: Large customers now require proof that high‑severity KEV items are tracked, mitigated, and documented in a continuous‑compliance platform.
Recommended Actions
- Prioritize Patch Deployment – Apply Cisco and Microsoft patches immediately; upgrade Metabase to a version that resolves CVE‑2026‑72898.
- Map to SOC 2 Controls – Record the vulnerability, remediation date, and responsible owner against CC6.1 and CC7.1 in your control inventory.
- Capture Automated Evidence – Use a continuous‑compliance tool to ingest patch‑management logs as immutable audit artifacts.
- Validate Post‑Remediation – Conduct targeted scans to confirm the flaw is no longer exploitable.
Source: Security Affairs – CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to KEV catalog