Metabase CVE-2026-72898: zero-day SQLi hits KEV with WinSock and Cisco

The three CVEs

Around August 11–13, 2026, CISA added to the KEV catalog:

• CVE-2026-72898 — unauthenticated SQL injection in Metabase (versions 1.58+), abused as a zero-day against Metabase Cloud;
• CVE-2026-68820 — use-after-free in the Windows WinSock driver (afd.sys), with possible elevation to SYSTEM;
• CVE-2026-20349 — unauthenticated DoS on Cisco Secure Firewall ASA/FTD via HTTP to the SSL VPN.

Metabase in detail

The Metabase flaw can lead to administrator access, credential theft and data exfiltration. The company reported Metabase Cloud attacks; self-hosted installs need immediate updates. Public BI panels often sit on the internet with little protection.

What to do

Update Metabase, apply the Windows WinSock patch and update ASA/FTD per Cisco’s advisory. Treat any public BI dashboard as a critical surface.

Sources

• Mallory: CISA Flags Exploited Metabase SQLi
• threat.wiki: CISA KEV August 11 additions