Skip to main content
Change Risk Intel
Cybersecurity

KEV Batch Triage: Three Owners, Two Deadlines, One Update

Ben Ennis Founder, Ennis Studio · former Partner Technology Advisor, ServiceNow · 11 min read

This article is operational change-management guidance for CAB and vulnerability-management teams, not incident-response or legal advice. Verify every deadline and fixed version against the CISA KEV catalog and the vendor advisory for your environment. No affiliate links appear below.

Table of contents

Why a batch KEV update is its own problem

Most of our emergency-change coverage has followed a single vulnerability through its clock, from the LoadMaster three-day KEV runbook to the SharePoint two-cycle patch. A single CVE is the easy case: one owner, one deadline, one change ticket.

The harder case is the one a change advisory board actually faces most weeks. CISA does not add exploited vulnerabilities one at a time on a convenient cadence. It publishes batches, and a single Known Exploited Vulnerabilities update can drop three unrelated products on three different teams with different enforced deadlines. The board’s job is no longer “patch this fast.” It is “sequence these correctly, in parallel, without letting the loudest CVSS number set the order.”

The August 11, 2026 KEV update is a clean teaching case. Three CVEs, three owner groups, two deadlines. Handled by reflex, a team patches the CVSS 10.0 first and treats the others as lower priority. Handled by triage, the board notices that two of the three share the earlier deadline and that the lowest-scored bug is riding an active rootkit campaign. The order changes once you stop sorting by severity score.

What CISA added on August 11

CISA added three actively exploited CVEs to the KEV catalog on August 11, 2026, each mapping to a different owner group.

Metabase, CVE-2026-72898, owned by the BI and analytics team. This is an unauthenticated SQL injection in the Metabase business-intelligence platform. A remote attacker injects arbitrary SQL through the /reset_password endpoint to gain administrator access to the instance, which can expose stored database credentials and data from every connected database (Tenable CVE-2026-72898 record). Metabase and NVD rate it CVSS 10.0 (NVD CVE-2026-72898 detail). It was exploited as a zero-day against Metabase Cloud tenants and self-hosted deployments before fixes shipped (Safe Security vulnerability roundup). Its CISA remediation deadline is August 14, 2026.

Cisco ASA and FTD, CVE-2026-20349, owned by the network and edge team. This is an unauthenticated remote denial-of-service in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD software. A single crafted HTTP request causes the appliance to reload, dropping the VPN for every remote worker (NVD CVE-2026-20349 detail). Cisco scores it CVSS 8.6, says there are no workarounds, and states it became aware of active exploitation earlier in the month (SecurityWeek on the Cisco firewall zero-day). It is exploitable only where the device runs a vulnerable configuration such as SSL-VPN, IKEv2 remote-access VPN with client services, or Zero Trust Network Access (The Hacker News on CVE-2026-20349). Its CISA deadline is also August 14, 2026.

Windows AFD.sys, CVE-2026-68820, owned by the endpoint and OS team. This is a use-after-free in the Ancillary Function Driver for WinSock, the kernel-mode driver behind the Windows Sockets API. An attacker who already has code running on a machine can escalate to SYSTEM by winning a race condition in the driver (The Hacker News on the AFD.sys zero-day). Microsoft scores it CVSS 7.0 and flags it as the only vulnerability in the August release confirmed exploited in the wild (SecurityWeek August 2026 Patch Tuesday coverage). Security researchers have reported the flaw being used to deliver a rootkit that disables endpoint protection, though attribution to a specific threat actor is not confirmed (Automox August 2026 Patch Tuesday analysis). Its CISA deadline is August 25, 2026.

Why CVSS is the wrong sort order

Sort those three by CVSS and Metabase leads at 10.0, Cisco follows at 8.6, and Windows trails at 7.0. Sort them by what actually constrains the change, and the picture inverts in useful ways.

Horizontal bar chart titled one KEV update, two deadlines, the highest CVSS is not the tightest clock. It plots three August 11 2026 KEV additions by business-critical days from August 12 to the BOD 22-01 patch deadline. CVE-2026-72898 Metabase for the BI analytics team shows 2 days to deadline at CVSS 10.0 in red. CVE-2026-20349 Cisco ASA FTD for the network edge team shows 2 days to deadline at CVSS 8.6 in red. CVE-2026-68820 Windows AFD.sys for the endpoint OS team shows 13 days to deadline at CVSS 7.0 in gray. A dashed line marks the August 14 deadline that both red bars fall under.

Two facts the CVSS column hides. First, the deadline is the hard constraint, and two of the three CVEs share the earlier August 14 date while the highest-impact-sounding Windows bug has until August 25. A board that spends August 12 and 13 perfecting the Metabase fix while ignoring the Cisco firewall misses that both are due on the same day, and the firewall change touches every remote worker’s connectivity.

Second, the CVSS number does not describe blast radius or exploitation momentum. The Cisco bug is “only” an availability issue, a denial-of-service, yet it sits on an internet-facing edge device with no workaround, so a missed patch is an open door to knocking your VPN offline on demand. The Windows bug is “only” a local privilege escalation with the lowest score in the set, yet it is the one CISA and Microsoft both confirm is being exploited right now, reportedly as part of a chain that disables endpoint defenses. Scoring by CVSS alone would deprioritize the two bugs with the most operational teeth. This is the same over-triage failure that vulnerability-scoring commentary keeps flagging: a base severity score was never meant to be a work-queue sort key (Help Net Security August 2026 Patch Tuesday forecast).

Sequencing the batch across three teams

A batch KEV update is a coordination problem before it is a patching problem. Here is the sequence a CAB runs.

Split the batch by owner on intake. The moment a multi-CVE KEV update lands, fan it out to the teams that own each asset: analytics for Metabase, network for Cisco, endpoint for Windows. Three owners can work in parallel; a single queue serializes work that did not need to be serial. Record each as its own emergency-change ticket with its own deadline.

Sort each ticket by deadline first, then blast radius, then score. Score each with a consistent rubric using our change risk score tool so the ranking is defensible, but let the enforced CISA deadline set the top of the queue. For this batch that puts Metabase and Cisco ahead of Windows on the calendar, and puts the internet-facing Cisco edge device ahead of the internal Metabase instance on blast radius when both are due the same day.

Confirm exposure before you commit a maintenance window. Not every asset is actually vulnerable. The Cisco bug only bites when a specific VPN configuration is enabled, so the network team confirms which appliances run SSL-VPN, IKEv2 with client services, or ZTNA before scheduling a reload (The Hacker News on CVE-2026-20349). Metabase administrators confirm whether their version is in the affected range and whether the instance is internet-reachable. Exposure confirmation is what turns a scary CVE list into a short, real work queue.

Run the CAB as a coordinated go or no-go. Because three teams are moving under two clocks, the board’s role is to confirm that each ticket has a tested rollback, that the Cisco reload is scheduled outside peak VPN hours, and that no two changes collide on a shared dependency. Use a scoped CAB agenda to keep the meeting to the decisions that matter. The rest of the emergency-change playbooks live on our cybersecurity pillar.

What to do about it

  1. Treat every KEV update as a batch, not a single item. On publication, split it by owner team and open one emergency-change ticket per CVE with its own CISA deadline recorded.
  2. Patch to the deadline, not the score. For the August 11 batch, Metabase (CVE-2026-72898) and Cisco ASA/FTD (CVE-2026-20349) are due August 14; Windows AFD.sys (CVE-2026-68820) is due August 25.
  3. Confirm exposure before scheduling. Check Cisco appliances for vulnerable VPN configurations and Metabase instances for affected versions and internet reachability before committing a window.
  4. Rotate secrets the SQL injection could have exposed. For Metabase, assume connected-database credentials may be compromised and rotate them as part of remediation, not after.
  5. Prioritize the actively exploited bug even when it scores lowest. The Windows AFD.sys flaw is the one confirmed exploited in the wild; do not let its 7.0 score push it to the bottom of the endpoint queue.
  6. Track live deadlines with a KEV feed. Keep the enforced dates in front of the board with our CISA KEV live tool so nothing slips past its clock.

FAQ

What CVEs did CISA add to the KEV catalog on August 11, 2026? CISA added three actively exploited CVEs: CVE-2026-72898, an unauthenticated SQL injection in Metabase; CVE-2026-20349, an unauthenticated denial-of-service in Cisco ASA and FTD firewalls; and CVE-2026-68820, a use-after-free privilege escalation in the Windows AFD.sys driver (Tenable CVE-2026-72898 record).

What are the CISA remediation deadlines for these three CVEs? The Metabase and Cisco CVEs both carry an August 14, 2026 deadline; the Windows AFD.sys CVE carries an August 25, 2026 deadline. Verify the exact dates against the CISA KEV catalog for your environment.

Should a CAB patch the highest-CVSS vulnerability first? Not automatically. CVSS describes technical severity, not deadline, exposure, or exploitation momentum. Sort a KEV batch by enforced deadline first, then blast radius and active-exploitation evidence, then use the CVSS score as a tiebreaker (Help Net Security August 2026 forecast).

Is the Cisco ASA CVE-2026-20349 remotely exploitable without authentication? Yes. An unauthenticated remote attacker can send a crafted HTTP request to the Remote Access SSL VPN service to force the appliance to reload, and Cisco reports no workarounds (SecurityWeek on the Cisco firewall zero-day).

Why is the lowest-scored CVE the most urgent for endpoint teams? CVE-2026-68820 scores CVSS 7.0, the lowest in the batch, but it is the only August 2026 vulnerability Microsoft confirms is exploited in the wild, reportedly in a chain that disables endpoint protection (SecurityWeek August 2026 Patch Tuesday coverage).

What remediation steps does the Metabase SQL injection require beyond patching? Because the flaw can expose credentials for every database connected to Metabase, treat those credentials as potentially compromised, rotate them as part of remediation, and review access logs on the affected instance (Tenable CVE-2026-72898 record).

Sources

#cisa-kev #vulnerability-triage #cab #cybersecurity #metabase #cisco-asa #afd-sys #emergency-change #bod-22-01

Published August 12, 2026.