CISA KEV Catalog Adds Seven Actively Exploited Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog with seven new security flaws that attackers are actively exploiting, several of them to drop reverse shells and cryptocurrency miners. The agency made the additions on Wednesday and, under Binding Operational Directive 26-04, federal civilian agencies must apply vendor patches by September 5, 2026, except for two Starlette and LiteLLM flaws that carry a September 16, 2026 deadline. The KEV catalog is a list of vulnerabilities with confirmed active exploitation, intended to help organizations prioritize urgent patching.

The first four additions affect widely used network and development tools. CVE-2026-83548 in SonicWall SMA 1000 Appliances is a server-side request forgery (SSRF) flaw with a maximum CVSS severity score of 10.0; it can let a remote unauthenticated attacker reach sensitive internal functionality. CVE-2026-83549, also in SonicWall SMA 1000, is a post-authentication operating system command injection flaw rated 7.8 that lets an authenticated administrator run arbitrary commands, leading to remote code execution. CVE-2026-9586 is an SQL injection vulnerability in Sangoma Switchvox rated 9.3; with one crafted request, an unauthenticated remote attacker can execute arbitrary SQL statements against the backend relational database used by many web applications, including database operations and remote code execution. CVE-2026-82329 is an improper authentication flaw in JFrog Artifactory rated 9.8; under default configuration, an unauthenticated attacker with network access can obtain administrative privileges. SonicWall said it has investigated a case indicating active exploitation of the two SMA 1000 flaws. Reports from Horizon3.ai and watchTowr describe unknown threat actors weaponizing CVE-2026-9586 and CVE-2026-82329 to deploy reverse shells and mint admin tokens for follow-on enumeration of users, groups, credential sets, and federated access topologies.

The remaining three additions include CVE-2026-48710, an HTTP request and response smuggling flaw in Kludex Starlette rated 6.5. Attackers can inject paths into the host part and prepend the actual path, which can bypass authentication when the check depends on the reconstructed URL path. In June 2026, Horizon3.ai reported that this vulnerability can be chained with another Berri LiteLLM flaw, CVE-2026-42271, rated 8.7, to bypass authentication and achieve remote code execution against vulnerable LiteLLM deployments. That LiteLLM flaw was also added to the KEV catalog around the same time. Google-owned Wiz has linked threat actors associated with Qilin ransomware, also called Agenda, to active exploitation of this chain. Wiz also observed exploitation attempts involving CVE-2026-59822 against its honeypots to probe model enumeration endpoints. CVE-2026-59822 is an improper authentication vulnerability in Berri LiteLLM's Model Context Protocol (MCP) Streamable HTTP endpoint rated 8.8; an unauthenticated attacker can establish an authenticated MCP session using an arbitrary Bearer token. CVE-2026-49869, a command injection flaw in Kestra OSS rated 10.0, lets an unauthenticated remote attacker create and execute arbitrary workflows without credentials.

Microsoft published a report last week describing the Kestra compromise in detail. According to Microsoft, the Kestra vulnerability was likely exploited by a threat actor in late June 2026 to establish a reverse shell, conduct Docker container environment discovery, perform defense evasion, deploy a cryptocurrency miner, and facilitate data harvesting. Microsoft identified four impact paths: shell execution through the workflow engine, container environment exposure through Docker socket access, host resource hijacking through miner deployment, and follow-on collection through workflow task execution. The attackers later used a curl-pipe-shell event to encode collected output and store it through Kestra's own key-value interface, reducing reliance on standalone file artifacts. Separately, Microsoft reported that malicious actors are breaking into LiteLLM gateways using CVE-2026-42271 and CVE-2026-48710 to deliver an XMRig miner via an ELF binary, after fingerprinting the host and terminating competing mining processes. The attackers also abuse previously collected database information to access the LiteLLM-backed relational database data tier and target tables such as LiteLLM_ProxyModelTable and LiteLLM_VerificationToken, harvesting records related to model configuration, upstream provider key material, provider endpoints, and proxy-issued virtual keys. The LiteLLM attack chain includes persistence through modification of the authorized SSH keys file, command-and-control (C2), and defense-evasion mechanisms.

Microsoft and Wiz both note that artificial intelligence (AI) infrastructure has become a lucrative target for attackers stealing API keys, gaining access to backend systems, maintaining persistence, running blind prompt injections and AI-native post-exploitation, and monetizing infected hosts through illicit cryptocurrency mining. Relevant tools include LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, Marimo, and MCP servers. In another Microsoft campaign report, adversaries are suspected of exploiting exposed RAGFlow instances using flaws such as CVE-2026-45312, CVE-2026-28797, CVE-2026-24770, CVE-2025-68700, and CVE-2025-69286 to establish persistence and steal large language model (LLM) provider keys and related metadata. Microsoft said the observed objectives were consistent across cases: credential collection, durable access mechanisms, and resource monetization, even though execution paths differed by product. The company recommended that defenders monitor AI workloads according to their control-plane role, not only as isolated applications.

For website owners and IT teams, these additions are a reminder that self-hosted network appliances, development repositories, workflow engines, and AI gateways are all exposed attack surface. Organizations that run SonicWall, Sangoma, JFrog, Starlette, Kestra, LiteLLM, or RAGFlow should check vendor security pages immediately, apply updates, restrict management interfaces to trusted networks, and monitor for unexpected outbound connections or high CPU load. For teams responsible for public-facing appliances or self-hosted AI tools, AEU-I provides security-first IT and infrastructure consulting that can help keep software patched and monitored.