Forwarded from TWCERTCC Cybersecurity Alert TWCERTCC-200-202608-00000013

【CVE-2026-20349】Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability (CVSS v3.1: 8.6)
【Whether exploited by ransomware: Unknown】Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability. An unauthenticated remote attacker may exploit this vulnerability to cause the device to unexpectedly reload, resulting in a denial-of-service condition.

【CVE-2026-68820】Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability (CVSS v3.1: 7.0)
【Whether exploited by ransomware: Unknown】Microsoft Windows Ancillary Function Driver for WinSock contains a Use-After-Free vulnerability. An authorized attacker may exploit this vulnerability to elevate privileges locally.

【CVE-2026-72898】Metabase SQL Injection Vulnerability (CVSS v3.1: 10.0)
【Whether exploited by ransomware: Unknown】Metabase contains an SQL Injection vulnerability. An unauthenticated remote attacker may exploit this vulnerability to inject arbitrary SQL commands into the Metabase application database, thereby obtaining administrator privileges for the instance. After obtaining privileges, the attacker may further modify application settings, steal stored credentials for connected databases, read any data accessible through those connections, and export the data.