CISA adds three vulnerabilities to its Known Exploited Vulnerabilities Catalog

CISA said Tuesday that it added three vulnerabilities to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation.

The agency said flaws like these are a frequent attack vector for malicious cyber actors and can pose risks to the federal enterprise. It said the catalog is intended to help organizations focus on issues most likely to be abused in the wild.

The source page did not list the three CVE identifiers in its extracted text, but the provided metadata identifies them as CVE-2026-20349, CVE-2026-68820 and CVE-2026-72898. Those entries are described as a Cisco Secure Firewall ASA/FTD heap inspection vulnerability, a Microsoft Windows Ancillary Function Driver for WinSock use-after-free vulnerability and a Metabase SQL injection vulnerability.

CISA said Binding Operational Directive 26-04, titled Prioritizing Security Updates Based on Risk, sets vulnerability management requirements for Federal Civilian Executive Branch agencies. The agency said the directive reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities on publicly exposed assets that grant total control after exploitation.

The agency also said the directive sets expectations for checking whether threat actors compromised a system before a patch was applied. CISA said that while BOD 26-04 applies only to Federal Civilian Executive Branch agencies, it encourages all organizations to adopt risk-based vulnerability management and prioritize fixes for cataloged vulnerabilities.

In the same alert, CISA said it will continue adding vulnerabilities that meet its criteria and invited submissions through its KEV Nomination Form. The agency said potential additions must have a CVE ID, evidence of exploitation and clear mitigation guidance.

Sources

• CISA alert: CISA adds three known exploited vulnerabilities to catalog

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.