CISA Adds Metabase, Windows, and Cisco Secure Firewall Flaws to Known Exploited Vulnerabilities Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three critical vulnerabilities affecting Metabase, Microsoft Windows, and Cisco Secure Firewall to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to remediate them by specific deadlines. These include a critical SQL injection in Metabase (CVE-2026-72898), a use-after-free vulnerability in Windows (CVE-2026-68820), and a heap inspection flaw in Cisco Secure Firewall (CVE-2026-20349).