CISA Flags Seven Exploited Flaws After Reverse Shell, Miner Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added seven security flaws to its Known Exploited Vulnerabilities (KEV) catalog, a public list of weaknesses that are being actively exploited and require urgent patching. The vulnerabilities span widely used products including SonicWall SMA 1000 appliances, Sangoma Switchvox, JFrog Artifactory, Kludex Starlette, Kestra OSS, and Berri LiteLLM. Each has a Common Vulnerability Scoring System (CVSS) score, a number from 0 to 10 that rates severity, with 10 being the most critical. The most severe are CVE-2026-83548 in SonicWall SMA 1000 (CVSS 10.0), a server-side request forgery flaw that could let an unauthenticated remote attacker access sensitive functionality and perform unauthorized operations; CVE-2026-49869 in Kestra OSS (CVSS 10.0), an operating system command injection flaw that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials; and CVE-2026-82329 in JFrog Artifactory (CVSS 9.8), an improper authentication flaw that under default configuration could allow an unauthenticated attacker with network access to obtain administrative privileges. Also added were CVE-2026-83549 in SonicWall SMA 1000 (CVSS 7.8), a post-authentication command injection flaw allowing a remote authenticated administrator to execute arbitrary OS commands; CVE-2026-9586 in Sangoma Switchvox (CVSS 9.3), an SQL injection flaw allowing unauthenticated execution of arbitrary SQL statements against a backend relational database used by many web applications; CVE-2026-48710 in Kludex Starlette (CVSS 6.5), an HTTP request/response smuggling weakness that could cause authentication bypass when authentication depends on a reconstructed URL path; and CVE-2026-59822 in Berri LiteLLM (CVSS 8.8), an improper authentication issue in the Model Context Protocol (MCP) Streamable HTTP endpoint that could let an unauthenticated attacker establish an authenticated session using an arbitrary Bearer token.

The additions come after SonicWall disclosed that it had investigated a case indicating active exploitation of CVE-2026-83548 and CVE-2026-83549. Reports from security firms Horizon3.ai and watchTowr described unknown threat actors weaponizing CVE-2026-9586 in Sangoma Switchvox and CVE-2026-82329 in JFrog Artifactory to deploy reverse shells, tools that make a compromised machine call back to the attacker so they can send commands remotely, and to mint admin tokens for follow-on enumeration of users, groups, credential sets, and federated access topologies. For CVE-2026-48710 in Starlette, a June 2026 report from Horizon3.ai found that the flaw could be chained with another Berri LiteLLM vulnerability, CVE-2026-42271 (CVSS 8.7), to bypass authentication and achieve remote code execution against vulnerable LiteLLM deployments, which are used to manage access to large language model services. CVE-2026-42271 was added to the KEV catalog around the same time. Google-owned Wiz linked threat actors associated with the Qilin ransomware, also known as Agenda, to active exploitation of that chain, and said it observed exploitation attempts involving CVE-2026-59822 against its honeypots, decoy systems designed to attract attackers, to probe model enumeration endpoints.

The inclusion of CVE-2026-49869 in Kestra OSS was prompted by a Microsoft report from last week. Microsoft said the vulnerability was likely exploited by a threat actor in late June 2026 to establish a reverse shell, perform Docker container environment discovery, carry out defense evasion, deploy a cryptocurrency miner, and harvest data. Docker is a platform that packages applications into isolated containers, and Kestra is an open-source workflow orchestration tool. Microsoft outlined four impact paths from the Kestra compromise: shell execution through the workflow engine, container-environment exposure through Docker socket access, host resource hijacking through miner deployment, and follow-on collection through workflow task execution. The report also noted that a later curl-pipe-shell event encoded collected output and stored it through Kestra's own key-value interface, reducing reliance on standalone file artifacts.

Microsoft separately described malicious actors breaking into LiteLLM gateways using CVE-2026-42271 and CVE-2026-48710 to deliver an XMRig miner, a program that mines the Monero cryptocurrency, via an ELF binary, the standard executable file format on Linux. Before deploying the miner, the attackers fingerprinted the host and terminated competing mining processes. They also abused previously collected database information to reach the LiteLLM-backed relational database data tier and target tables named LiteLLM_ProxyModelTable and LiteLLM_VerificationToken. From there they harvested records containing model configuration, upstream provider key material, provider endpoints, and proxy-issued virtual keys. The attack chain also included persistence through modification of the authorized_keys file used for SSH logins, command-and-control communication, and defense-evasion mechanisms. Microsoft and Wiz said these attacks show that artificial intelligence infrastructure, including LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, Marimo, and MCP servers, has become a lucrative target for stealing API keys, gaining access to backend systems, maintaining persistence, conducting blind prompt injections, performing AI-native post-exploitation, and monetizing infected hosts through illicit cryptocurrency mining. API keys are secret tokens that applications use to verify access to services.

In another campaign documented by Microsoft, adversaries are suspected of exploiting exposed RAGFlow instances, which are open-source retrieval-augmented generation platforms, using flaws CVE-2026-45312, CVE-2026-28797, CVE-2026-24770, CVE-2025-68700, and CVE-2025-69286. The goal in these cases was to establish persistence and steal large language model (LLM) provider keys and related metadata. Microsoft said the observed objectives were consistent across the cases; telemetry showed credential collection, durable access mechanisms, and resource monetization, even though the execution path differed by product. The company advised defenders to monitor AI workloads according to their control-plane role, not only as isolated applications.

Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies are recommended to apply patches for all the newly added vulnerabilities except CVE-2026-48710 and CVE-2026-59822 by September 5, 2026. Agencies have until September 16, 2026, to address the Starlette and LiteLLM flaws. For website owners, businesses, and IT teams, the lesson is that internet-facing software must be patched quickly and monitored for signs of abuse such as unexpected high CPU usage, unfamiliar processes, or unusual outbound connections. For website operators who prefer to offload the burden of patching and hardening, AEU Hosting provid