CISA Added Three CVEs Yesterday. Two Sit on Surfaces Far Hotter Than Any Leaderboard Shows, Because the Product Names Changed. One Traces to a 1993 API.

Microsoft shipped its August Patch Tuesday on the 11th. Cisco published an advisory the same day. CISA added three CVEs to the Known Exploited Vulnerabilities catalog on the same date.

Most of the coverage counted the CVEs and moved on. We ran the batch against our own KEV index instead, and two of the three turned out to be sitting on attack surfaces that are among the most repeatedly exploited in the catalog — surfaces that do not appear on anyone's "most exploited products" chart, because the vendors renamed them.

That is the finding. The recurrence is real, it is computable, and the catalog's own product field hides it.

First, the honest count

Three outlets reported three different numbers for the same Patch Tuesday: 398 CVEs, 400, and 421. The gap is mostly Chromium-derived Edge CVEs and what each counts as "this month." We are using 398 for the Microsoft-proper figure — 42 critical, 355 important, one moderate — and flagging the spread rather than pretending there is one clean number. If you see this month cited as a record, check which denominator the writer used.

What actually got added to KEV on 2026-08-11 was three things, and only three:

CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver for WinSock, due 2026-08-25. CVE-2026-20349, an unauthenticated remote denial of service in Cisco Secure Firewall ASA and FTD, due 2026-08-14. CVE-2026-72898 in Metabase, also due 2026-08-14.

Finding one: afd.sys is a five-time KEV surface, and the API is from 1993

CVE-2026-68820 is a use-after-free in afd.sys, the kernel-mode driver behind the Windows Sockets API. Local attacker, elevation to SYSTEM. Check Point reported that North Korean Lazarus operators exploited it as a zero-day to deploy a new version of the FudModule kernel rootkit.

Query our KEV index for that driver and you do not get one entry. You get five:

CVE-2011-2005, Ancillary Function Driver improper input validation, added 2022-03-28. CVE-2024-38193, WinSock privilege escalation, added 2024-08-13. CVE-2025-21418, WinSock heap-based buffer overflow, added 2025-02-11. CVE-2025-32709, WinSock use-after-free, added 2025-05-13. And now CVE-2026-68820, WinSock use-after-free, added 2026-08-11.

Four of those five arrived in the last twenty-four months. The last three are the same escalation story told three times: heap overflow, use-after-free, use-after-free — all local, all to SYSTEM.

And Lazarus has now used this one driver twice. CVE-2024-38193 in August 2024, and CVE-2026-68820 this week — both to load FudModule. Two years apart, same actor, same driver, same objective. That is not a claim about sophistication, which is unfalsifiable and which we try not to make. It is two dated observations of one actor returning to one attack surface, and you can check both dates against the catalog yourself.

Here is the part worth sitting with. The Windows Sockets API that afd.sys implements in the kernel is not new. The Winsock 1.1 specification was published in January 1993. Windows for Workgroups 3.11 shipped that November with Microsoft's Winsock implementation, and the NT line carried its own from the start. The interface contract this driver services is thirty-three years old, and it produced an actively exploited SYSTEM escalation this week.

The driver itself is commonly dated to Windows NT 3.51, which shipped in May 1995. Nobody is claiming the current afd.sys contains 1995 code — it has been rewritten many times over thirty years. The point is narrower and more uncomfortable: the architectural position is unchanged. A kernel driver introduced in the NT 3.51 era, servicing an API contract specified in January 1993, is still the thing standing between a local process and SYSTEM in 2026 — and it has yielded five times.

If you want to feel the vintage properly: NT 3.51 is the platform Citrix built WinFrame on, the ancestor of MetaFrame and of every remote-access session product that followed. Which is a pointed coincidence, because the other actively exploited CVE in yesterday's batch is a remote-access VPN concentrator. Both of the surfaces CISA flagged on 2026-08-11 are the mid-nineties Windows networking and remote-access stack, still load-bearing, still being exploited.

Finding two: Cisco ASA has 14 KEV entries and appears on no leaderboard

CVE-2026-20349 lets an unauthenticated remote attacker force an ASA or FTD firewall to reload by sending crafted HTTP requests to the Remote Access SSL VPN service. CVSS 8.6. No workaround. Cisco found it in internal testing; researcher Valerio Brussani independently reported the same issue. Cisco says it became aware of active exploitation earlier this month.

Now count the platform's history in KEV. Fourteen entries, going back to CVE-2016-6366 and running through yesterday.

Fourteen would place ASA around twelfth all-time, level with Cisco IOS and IOS XE, ahead of Samsung Mobile Devices and Adobe Acrobat. It does not appear in the top fifteen. It does not appear anywhere, because those fourteen entries are filed under five different product strings:

Six as "Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)." Four as "Adaptive Security Appliance (ASA)." Two as "Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense." One as "Adaptive Security Appliance and Firepower Threat Defense." And one — yesterday's — as "Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)," with a trailing space that makes it its own distinct string in any exact-match aggregation.

Cisco rebranded ASA to Secure Firewall and Firepower to Threat Defense. Every rename split the history. Any analyst who groups KEV by the product field — which is the obvious, documented way to do it — sees a platform with six hits where the reality is fourteen.

The same defect hides afd.sys harder. Its five entries carry three different product strings, and three of them are filed under the generic product "Windows," which holds 170 entries. Group by product and afd.sys does not exist as a surface at all. You only find it by searching the vulnerability name.

If your prioritization asks "which of my products keep showing up in KEV," the catalog will under-answer for exactly the platforms that have been exploited longest, because longevity is what earns a product a rebrand.

Finding three: CISA's patch clock has quietly become three days

We published yesterday that CISA had stopped issuing 21-day deadlines. Running the numbers again against the fresh catalog, the claim holds and is sharper than we put it: the last 21-day deadline CISA issued was 2026-02-12. Nothing since.

The 2026 distribution, by remediation interval:

Two entries at 2 days. Seventy-three at 3 days. One at 5. Sixty-one at 14. Fifteen at 20. Twenty-nine at 21 — all of them in January and February.

By month, the shift is not subtle. January ran 15 entries at 21 days and 2 at 3 days. July ran 22 of 26 at 3 days. Three days is now the modal federal remediation deadline, and the three-week deadline is simply gone.

Which brings us to the practical point of this entire post: [CVE-2026-20349](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-20349) is due August 14. That is Friday, two days from publication. An unauthenticated remote reload of an internet-facing VPN concentrator, no workaround available, on a platform with fourteen prior KEV entries. If you run ASA or FTD with Remote Access SSL VPN exposed, that is the thing to do today.

Finding four: nobody has published a working PoC yet

We hunted public code for all four CVEs in play. As of this writing:

CVE-2026-20349, the actively exploited Cisco DoS: zero public repositories. CVE-2026-68820, the Lazarus afd.sys zero-day: one repository, created 2026-08-13, whose own description reads "Draft or TODO" — a placeholder, not an exploit. CVE-2026-72898, Metabase: one repository, created 2026-08-12, unverified. CVE-2026-72971, the publicly-disclosed container-isolation bug Microsoft rates unlikely to be exploited: zero.

This is the gap that matters operationally and that most Patch Tuesday coverage skips. Two of these are being exploited right now by capable operators, and the commodity exploitation wave has not started, because there is no public exploit to commoditize. The window between "used by a nation-state" and "used by everyone with a GitHub search bar" is open, and it is the cheapest window you will ever get.

Placeholder repositories claiming a CVE number are worth watching for a different reason: they are frequently the first move in a fake-PoC scam, where the repo fills later with a stealer rather than an exploit. A repo named for a Lazarus zero-day, created the day after disclosure, containing nothing, is not yet a threat and is not yet a tool. It is a reservation on your attention.

What we did

We are not claiming a lead on any of this. Check Point found the Lazarus exploitation and did the FudModule attribution. Cisco found its own bug and credited the independent reporter. CISA catalogued all three the same day. We were reading the wire like everyone else.

What we contributed is the aggregation nobody else ran: the five-entry afd.sys history, the fourteen-entry ASA history hiding behind five product strings, the collapse of the federal patch clock to three days, and the confirmed absence of public exploit code. All of it computed from the catalog CISA publishes free, which means all of it is checkable, and any of it could be wrong.

Call it 95 percent, as always. The product-string counts in particular depend on exact-match grouping — if you normalize differently you will get different numbers, and we would rather you run it yourself than take ours.

The short version

Patch Cisco ASA and FTD by Friday. Patch afd.sys on the normal cycle unless you are a plausible North Korean target, in which case treat it as urgent. Stop grouping KEV by the product field alone, because it undercounts your oldest and most-attacked platforms.

And notice what CISA actually flagged this week: a socket driver from NT 3.51 and a remote-access gateway. Thirty-one years of rewrites, rebrands and acquisitions later, the two things being exploited are the same two things that were novel when Citrix was selling WinFrame. The names on the boxes changed enough to break the catalog's own grouping. The attack surface did not move at all.

---

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register

---

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=cisa-added-three-cves-yesterday-two-sit-on-surfaces-far-hotter-than-any-leaderboard-shows-because