CISA Adds Seven Exploited Vulnerabilities to Its Catalog

On Wednesday the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added seven new entries at once to its Known Exploited Vulnerabilities (KEV) catalog. All of them are already in attackers' crosshairs.

What's on the list

The roundup includes two flaws in SonicWall SMA 1000 gateways — the SSRF vulnerability CVE-2026-83548 with a maximum CVSS score of 10.0, which lets an unauthenticated attacker reach sensitive functions, and the post-authentication command injection CVE-2026-83549, which leads to remote code execution. SonicWall itself has confirmed that it investigated a case of their active exploitation.

The remaining entries are no less serious: a SQL injection in Sangoma Switchvox (CVE-2026-9586), an authentication bypass in JFrog Artifactory (CVE-2026-82329, CVSS 9.8) that grants administrator privileges under default settings, and a command injection in Kestra OSS (CVE-2026-49869, CVSS 10.0). Rounding out the list are an HTTP request smuggling vulnerability in Starlette (CVE-2026-48710) and an authentication weakness in the MCP endpoint of Berri LiteLLM (CVE-2026-59822).

Reverse shells, miners and a hunt for keys

According to Horizon3.ai and watchTowr, unidentified groups are already leveraging the Switchvox and Artifactory flaws to install reverse shells and issue bogus admin tokens, then to enumerate users, groups and sets of credentials. The Kestra vulnerability, as Microsoft reported, was used in late June to launch a reverse shell, carry out reconnaissance inside a Docker environment, evade defenses and deploy a cryptominer.

Researchers are paying particular attention to artificial intelligence infrastructure. The combination of CVE-2026-48710 and CVE-2026-42271 makes it possible to bypass authentication and execute code in vulnerable LiteLLM deployments; according to Wiz, operators of the Qilin ransomware (also known as Agenda) are behind its exploitation. The attackers deliver the XMRig miner, first “fingerprinting” the host and terminating competing mining processes, and then siphon model configurations, provider keys and virtual proxy keys out of LiteLLM's PostgreSQL tables. To maintain persistence, they edit ~/.ssh/authorized_keys.

Microsoft and Wiz note that AI components — LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama and MCP servers — have become an attractive target: they are used to steal API keys, gain access to back ends, establish persistence and monetize infected hosts through cryptocurrency mining. In a separate campaign, attackers are targeting exposed RAGFlow instances to steal LLM provider keys.

Deadlines

Under directive BOD 26-04, federal civilian agencies are required to remediate most of the vulnerabilities by September 5, 2026. For the Starlette and LiteLLM flaws the deadline has been extended to September 16.

Source: The Hacker News