The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added seven security flaws to its Known Exploited Vulnerabilities (KEV) catalog after they landed in attackers' crosshairs.
The vulnerabilities are as follows -
- CVE-2026-83548 (CVSS score: 10.0) - A server-side request forgery vulnerability in SonicWall SMA 1000 Appliances that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.
- CVE-2026-83549 (CVSS score: 7.8) - A post-authentication operating system command injection vulnerability in SonicWall SMA 1000 Appliances that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
- CVE-2026-9586 (CVSS score: 9.3) - An SQL injection vulnerability in Sangoma Switchvox that could allow an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
- CVE-2026-82329 (CVSS score: 9.8) - An improper authentication vulnerability in JFrog Artifactory that under default configuration could allow an unauthenticated attacker with network access to obtain administrative privileges.
- CVE-2026-48710 (CVSS score: 6.5) - An HTTP request/response smuggling vulnerability in Kludex Starlette that could allow attackers to inject paths into the host part, prepending the actual path, leading to issues such as authentication bypass when the authentication depends on the reconstructed URL's path.
- CVE-2026-49869 (CVSS score: 10.0) - An operating system command injection vulnerability in Kestra OSS that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.
- CVE-2026-59822 (CVSS score: 8.8) - An improper authentication vulnerability in Berri LiteLLM's Model Context Protocol (MCP) Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.
The development comes after SonicWall disclosed that it "investigated a case indicating the active exploitation" of CVE-2026-83548 and CVE-2026-83549. According to reports from Horizon3.ai and watchTowr, unknown threat actors have been observed weaponizing CVE-2026-9586 and CVE-2026-82329 to deploy reverse shells and and minted admin tokens for follow-on enumeration of users, groups, credential sets, and federated access topologies.
As for CVE-2026-48710, a report from Horizon3.ai in June 2026 revealed that the vulnerability could be chained alongside another Berri LiteLLM flaw (CVE-2026-42271, CVSS score: 8.7) to bypass authentication and achieve remote code execution against vulnerable LiteLLM deployments.
It's worth noting that CVE-2026-42271 was added to CISA's KEV catalog around the same time. Per Google-owned Wiz, threat actors associated with the Qilin (aka Agenda) ransomware have been linked to active exploitation of this chain. The cloud security platform said it has also observed exploitation efforts involving CVE-2026-59822 against its honeypots to probe model enumeration endpoints.
The addition of CVE-2026-49869 to the KEV catalog is driven by a Microsoft report last week in which the vulnerability was likely exploited by a threat actor in late June 2026 to establish a reverse shell, conduct Docker container environment discovery, perform defense evasion, deploy a cryptocurrency miner, and facilitate data harvesting.
| Kestra compromise attack chain |
"The Kestra compromise exposed four impact paths: shell execution through the workflow engine, container-environment exposure through Docker socket access, host resource hijacking through miner deployment, and follow-on collection through workflow task execution," Microsoft said.
"The later curl-pipe-shell event encoded collected output and stored it through Kestra's own key-value interface, reducing reliance on standalone file artifacts."
Separately, the Windows maker also revealed that malicious actors are breaking into LiteLLM gateways using CVE-2026-42271 and CVE-2026-48710 to deliver an XMRig miner via an ELF binary, but not before fingerprinting the host and terminating competing mining processes.
The attackers have also been found to abuse previously collected database information to access the LiteLLM-backed PostgreSQL data tier and target LiteLLM tables, including LiteLLM_ProxyModelTable and LiteLLM_VerificationToken, to harvest records related to model configuration, upstream provider key material, provider endpoints, and proxy-issued virtual keys.
Furthermore, the attack chain is characterized by the addition of persistence using "~/.ssh/authorized_keys" modification, command-and-control (C2), and defense-evasion mechanisms.
The attacks, Microsoft and Wiz said, indicate artificial intelligence (AI) infrastructure, such as LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, Marimo, and MCP servers, has become a lucrative target to steal API keys, gain access to backend systems, maintain persistence, engage in blind prompt injections and AI-native post-exploitation, and monetize infected hosts through illicit cryptocurrency mining.
In another campaign documented by Redmond, it's suspected that adversaries are exploiting exposed RAGFlow instances using flaws like CVE-2026-45312, CVE-2026-28797, CVE-2026-24770, CVE-2025-68700, and CVE-2025-69286 to establish persistence and steal large language model (LLM) provider keys and related metadata.
"The observed objectives were consistent. Across the cases, telemetry showed credential collection, durable access mechanisms, and resource monetization, even though the execution path differed by product," Microsoft said. "Defenders should monitor AI workloads according to their control-plane role, not only as isolated applications."
Pursuant to "Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk," Federal Civilian Executive Branch (FCEB) agencies are recommended to apply patches for all the vulnerabilities, barring CVE-2026-48710 and CVE-2026-59822, by September 5, 2026. Agencies have time until September 16, 2026, to address the Starlette and LiteLLM flaws.
Facts Only
CISA added seven security flaws to the Known Exploited Vulnerabilities (KEV) catalog on Wednesday.
CVE-2026-83548 and CVE-2026-83549 affect SonicWall SMA 1000 Appliances.
CVE-2026-9586 affects Sangoma Switchvox.
CVE-2026-82329 affects JFrog Artifactory.
CVE-2026-48710 affects Kludex Starlette.
CVE-2026-49869 affects Kestra OSS.
CVE-2026-59822 affects Berri LiteLLM.
Microsoft, Wiz, Horizon3.ai, and watchTowr reported on the exploitation of these flaws.
Qilin ransomware has been linked to the exploitation of a chain involving CVE-2026-42271 and CVE-2026-48710.
FCEB agencies must patch most of these vulnerabilities by September 5, 2026.
FCEB agencies must patch CVE-2026-48710 and CVE-2026-59822 by September 16, 2026.
Executive Summary
CISA has expanded its Known Exploited Vulnerabilities catalog to include seven new flaws affecting a diverse range of software, including SonicWall appliances, JFrog Artifactory, and various AI-related infrastructure like LiteLLM and Kestra OSS. These vulnerabilities vary in severity, with several carrying critical CVSS scores of 9.8 to 10.0, enabling remote code execution, unauthorized administrative access, and SQL injection.
Recent threat intelligence indicates a concerted effort by actors, including the Qilin ransomware group, to target AI-native tools. Attackers are chaining vulnerabilities to bypass authentication, deploy cryptocurrency miners, and harvest API keys and provider metadata from PostgreSQL databases. This trend suggests that AI orchestration layers have become high-value targets for monetization and persistence. Federal agencies are under a binding directive to remediate these flaws by mid-September 2026, highlighting the urgency of the risk.
Full Take
The strongest version of this narrative is a timely warning that the rapid adoption of AI infrastructure has outpaced the security rigor applied to it. By targeting "plumbing" like LiteLLM and Kestra, attackers are not attacking the AI models themselves, but the orchestration layers that manage the keys and data flowing into those models.
This is a classic "Gold Rush" pattern. As enterprises rush to deploy RAG (Retrieval-Augmented Generation) and LLM gateways, they create a new, fertile attack surface. The paradigm here is a shift from targeting the application to targeting the infrastructure of intelligence. The unstated assumption is that these AI tools are being deployed with default configurations and insufficient network isolation, making them "low-hanging fruit" for both state-sponsored actors and ransomware groups.
The implication is a potential erosion of trust in AI deployments. If the "control plane" of AI is porous, the integrity of the output is irrelevant because the underlying secrets—API keys and provider tokens—are compromised. The cost is borne by the end-users whose data is harvested, while the benefit goes to opportunistic miners and ransomware operators.
Patterns detected: none
Root Cause: The "Innovation Gap," where the speed of deployment for AI-native tooling exceeds the implementation of basic security hygiene (e.g., changing default configurations).
Bridge Questions: Are we treating AI orchestration tools as "apps" when we should be treating them as critical network infrastructure? If the attack vector is the orchestration layer, does the security of the LLM itself even matter?
Counterstrike Scan: A coordinated campaign would amplify these findings to create a "fear-cycle," pushing a specific proprietary security product as the only solution to "AI-native" threats. The current content remains a technical summary of CVEs and agency directives, matching standard threat intelligence rather than a marketing playbook.