CISA KEV Catalog Adds Seven Exploited Flaws Across AI Stacks and VPNs

CISA just put an AI workflow engine on the same actively-exploited list it has long kept for perimeter VPN appliances. On September 3, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) placed seven flaws on its Known Exploited Vulnerabilities (KEV) catalog . Read as a set, the CISA KEV catalog additions map the modern AI control plane as much as the network edge.

The additions split into two worlds: enterprise edge gear, including SonicWall SMA 1000 remote-access appliances, Sangoma Switchvox phone systems, and JFrog Artifactory, alongside the AI toolchain of Kestra, Berri LiteLLM, and Kludex Starlette.

Microsoft tied the maximum-severity Kestra flaw to a late-June intrusion that opened a reverse shell, mapped the Docker environment, and dropped a cryptocurrency miner.

Wiz linked the Qilin ransomware crew, also tracked as Agenda, to a LiteLLM exploit chain that harvests upstream model-provider keys straight from the proxy’s PostgreSQL tables.

Under Binding Operational Directive (BOD) 26-04, federal agencies faced a September 5 patch deadline for five of the flaws, with the Starlette and LiteLLM bugs due by September 16.

Seven Exploited Flaws Land on the CISA KEV Catalog

In late June 2026, an attacker reached an exposed instance of Kestra, the open-source workflow-orchestration engine, and treated it as a foothold. Microsoft’s threat researchers traced the intrusion to CVE-2026-49869 , an unauthenticated command-injection flaw rated a maximum 10.0. From the workflow engine the attacker opened a reverse shell, enumerated the Docker container environment, hijacked host resources for a cryptocurrency miner, and harvested data through Kestra’s own key-value store.

That compromise is one of seven actively exploited vulnerabilities CISA catalogued on September 3. The heaviest hitter is a SonicWall SMA 1000 chain: CVE-2026-83548 , a server-side request forgery bug rated 10.0, pairs with CVE-2026-83549, a command-injection flaw, to give an unauthenticated attacker remote code execution. Horizon3.ai and watchTowr, both offensive-security research firms, reported reverse shells and minted admin tokens flowing from an SQL-injection flaw in Sangoma Switchvox and an authentication bypass in JFrog Artifactory.

Why the AI Control Plane Is Now Prime Attack Surface

The edge-appliance flaws are routine patch-cycle fare. The AI entries are the signal. Microsoft and Wiz, the cloud-security firm now owned by Google, describe attackers going after LiteLLM, the open-source proxy that fronts large language model (LLM) APIs. The same reports name Flowise, LangChain, Langflow, ChromaDB, Ollama, and Model Context Protocol (MCP) servers as targets. The draw is concentration: a single LiteLLM proxy holds upstream provider key material and proxy-issued virtual keys in its own database tables, so one compromised proxy cascades to every model provider behind it.

The chains bear this out. Wiz watched the Qilin ransomware crew pair CVE-2026-48710, an HTTP request smuggling flaw in Starlette, with an earlier LiteLLM bug to bypass authentication. The chain then reached the proxy’s PostgreSQL tables to lift model configurations and provider endpoints. A newer entry, CVE-2026-59822 , lets an attacker forge an authenticated MCP session with any bearer token, and Wiz has already seen it probed against its honeypots. Our earlier reporting on AI gateway cryptomining flagged the same lesson: the gateway is an identity boundary, and the cryptominer is the noisy tenant that reveals it.

Microsoft’s own guidance is to “monitor AI workloads according to their control-plane role, not only as isolated applications,” which reframes AI security from a model-safety problem into an infrastructure-exposure problem most inventories have not solved.

How to Patch Before the September 16 LiteLLM Deadline

Sequence the response by exploitation evidence over raw severity score, the same triage logic behind surviving the 2026 CVE surge . Everything here is already being used in the wild, so the order is: contain what is past deadline, then inventory the AI layer, then rotate what the AI layer could leak.

Treat the September 5 miss as an active incident – For federal agencies and anyone running SonicWall SMA 1000 or JFrog Artifactory, the BOD 26-04 deadline for five flaws has already passed. Horizon3.ai and watchTowr watched reverse shells land, so hunt for compromise before you close the ticket.

Inventory AI infrastructure by its control-plane role – Pull LiteLLM, Kestra, and MCP endpoints into your cloud-identity runbook. Microsoft found the same credential-theft and durable-access objectives across every product it studied.

Rotate every provider key a LiteLLM proxy has touched – Patching CVE-2026-59822 and the Starlette flaw closes the door. The harvested upstream keys and virtual keys still work, so rotate them and revoke issued tokens before the September 16 deadline.

Read together, this CISA KEV catalog update marks AI plumbing as enterprise attack surface with a federal compliance clock attached. The Kestra server that ran a miner in late June was patchable in an afternoon; the model-provider keys reachable from that workflow engine are the part that stays stolen.