CISA Adds Seven Exploited Flaws to KEV Catalog
CISA Adds Seven Actively Exploited Flaws to KEV Catalog
CVE Identifiers
MITRE ATT&CK Techniques
Exploit Public-Facing Application
External Remote Services
Exploitation for Privilege Escalation
Command and Scripting Interpreter: Unix Shell
Resource Hijacking
Data from Information Repositories: Sharepoint
Full Report(when first published)
Executive Summary
On September 2, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added seven actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. This action mandates that Federal Civilian Executive Branch (FCEB) agencies remediate these flaws under accelerated timelines set by the new Binding Operational Directive (BOD) 26-04. The vulnerabilities affect a range of products, including SonicWall SMA 1000 appliances, Kestra OSS, and JFrog Artifactory. Exploitation in the wild has been confirmed, with activities ranging from cryptocurrency mining and data harvesting to ransomware deployment by groups such as Qilin.
Vulnerability Details
The seven vulnerabilities added to the KEV catalog represent significant risks to organizations due to confirmed in-the-wild exploitation. The flaws and their impacts are as follows:
CVE-2026-83548: A critical server-side request forgery (SSRF) vulnerability in SonicWall SMA 1000 appliances with a CVSS score of 10.0. It allows an unauthenticated attacker to access sensitive functionality and is being chained withCVE-2026-83549.CVE-2026-83549: A post-authentication OS command injection vulnerability in SonicWall SMA 1000 appliances (CVSS 7.8). When chained, it allows for full remote code execution.CVE-2026-49869: A critical OS command injection vulnerability in Kestra OSS (CVSS 10.0). Microsoft reported its exploitation to establish reverse shells, deploy cryptocurrency miners, and exfiltrate data.CVE-2026-82329: A critical improper authentication vulnerability in JFrog Artifactory (CVSS 9.8). Attackers are exploiting this to gain administrative privileges by minting admin tokens.CVE-2026-9586: An SQL injection vulnerability in Sangoma Switchvox (CVSS 9.3), enabling attackers to exfiltrate database information.CVE-2026-48710: An HTTP request smuggling flaw in Kludex Starlette (CVSS 6.5). Its exploitation has been linked to the Qilin ransomware group.CVE-2026-59822: An improper authentication bug in Berri LiteLLM (CVSS 8.8). This is also being exploited by Qilin to target AI infrastructure, steal API keys, and monetize compromised hosts.
Affected Systems
The following products and versions are confirmed to be affected by the vulnerabilities added to the KEV catalog:
- SonicWall SMA 1000 series appliances
- Kestra OSS
- JFrog Artifactory
- Sangoma Switchvox
- Kludex Starlette
- Berri LiteLLM
Exploitation Status
All seven vulnerabilities have confirmed evidence of active exploitation in the wild. Attackers are using the Kestra flaw for resource hijacking and data theft. The JFrog vulnerability is being used to gain administrative control. The SonicWall flaws are being chained for unauthenticated remote code execution. The Starlette and LiteLLM vulnerabilities are being leveraged by the Qilin ransomware group in attacks on AI infrastructure.
Impact Assessment
The addition of these vulnerabilities to the KEV catalog underscores their significant risk. For FCEB agencies, the deadlines under BOD 26-04 are non-negotiable, with most requiring remediation by September 5, 2026. For private organizations, these vulnerabilities pose a severe threat of network compromise, data exfiltration, ransomware deployment, and resource hijacking. The exploitation of flaws in remote access solutions like SonicWall SMA 1000 and AI-related tools like LiteLLM highlights threat actors' focus on high-value perimeter devices and emerging technology stacks.
Cyber Observables — Hunting Hints
Security teams can hunt for potential exploitation activity related to these vulnerabilities. The following patterns could indicate related activity:
/cgi-bin/sslvpn-loginxmrigArtifactory access logsOutbound traffic to known cryptomining poolsDetection & Response
Defenders should prioritize detection strategies focused on both initial access and post-exploitation activity.
- Network Monitoring: Implement rules to detect anomalous requests to affected appliances like SonicWall SMA 1000. Monitor for SSRF signatures, such as URLs containing internal IP addresses or localhost. Use Network Traffic Analysis (D3-NTA) to baseline traffic from these devices and alert on unusual outbound connections.
- Log Analysis: Ingest and analyze web server, application, and authentication logs from all affected products. For the JFrog flaw, search for anomalous token creation events. For Kestra, look for child processes spawned by the Kestra service, especially shell processes (
sh,bash) or tools likecurlandwget. - Endpoint Detection (EDR): Deploy EDR agents on servers hosting these applications. Monitor for suspicious process chains, command-line arguments, and file modifications. A rule to detect a Java process spawning a shell is a high-fidelity indicator for the Kestra flaw.
Mitigation
The most effective mitigation is to apply the security updates provided by the respective vendors immediately. However, where patching is not immediately feasible, consider the following compensating controls:
- Patch Management: Prioritize applying patches for all seven vulnerabilities, starting with internet-facing systems. This is the most critical action. This aligns with D3FEND Software Update (D3-SU).
- Restrict Access: Limit network access to the management interfaces of affected devices. For SonicWall SMA and JFrog Artifactory, ensure management portals are not exposed to the public internet and are only accessible from a trusted internal network or via a secure VPN.
- Web Application Firewall (WAF): Deploy a WAF with rulesets designed to block SSRF, SQL injection, and command injection attacks. This can provide a virtual patch while testing and deploying official vendor updates.
- Network Segmentation: Segment networks to prevent lateral movement from a compromised perimeter device. This can limit the blast radius if an attacker successfully exploits a flaw like the one in the SonicWall appliance.
Timeline of Events
Article Updates
September 4, 2026
New analysis highlights that three of the seven CISA KEV vulnerabilities specifically target AI/ML infrastructure, leading to risks like supply chain attacks and model theft.
Update Sources:
MITRE ATT&CK Mitigations
Update Software
Applying vendor-supplied patches is the most effective way to remediate these vulnerabilities.
Mapped D3FEND Techniques:
Restrict access to management interfaces of affected products to trusted networks, preventing exposure to the public internet.
Mapped D3FEND Techniques:
Network Intrusion Prevention
Use an IPS or WAF to inspect traffic for signatures of SSRF, SQLi, and command injection to block exploitation attempts.
D3FEND Defensive Countermeasures
Immediately prioritize the deployment of security patches released by SonicWall, Kestra, JFrog, and other affected vendors. Given the active exploitation and inclusion in the CISA KEV catalog, these updates should be treated as emergencies. The patching process should begin with internet-facing systems, such as the SonicWall SMA 1000 appliances, to close the initial access vector. Utilize a robust patch management program to scan the environment, identify all vulnerable instances, and track the deployment of updates. For federal agencies, adherence to the BOD 26-04 deadlines is mandatory. For all other organizations, treating these deadlines as a benchmark for risk reduction is a best practice. Verify successful patch application using vulnerability scanners or by checking version numbers manually.
As a compensating control, implement strict inbound traffic filtering for all affected applications. For the SonicWall SMA 1000, JFrog Artifactory, and other internet-exposed services, create firewall rules that restrict access to their management interfaces to a small set of trusted IP addresses, such as corporate VPN gateways or dedicated administrative jump hosts. This dramatically reduces the attack surface available to external adversaries. Additionally, deploy a Web Application Firewall (WAF) or Intrusion Prevention System (IPS) in front of these applications. Configure the WAF/IPS with rules to detect and block common attack patterns like Server-Side Request Forgery (SSRF), SQL Injection (SQLi), and command injection, providing a layer of virtual patching against the specific vulnerability types listed in the CISA alert.
Deploy and configure Endpoint Detection and Response (EDR) agents on servers hosting applications like Kestra OSS to perform deep process analysis. The exploitation of CVE-2026-49869 involves command injection leading to reverse shells and cryptocurrency miners. EDR tools should be configured to monitor for anomalous process creation events. Specifically, create detection rules that alert when the Kestra Java process spawns child processes like sh, bash, curl, wget, or any unrecognized binary. Establish a baseline of normal process behavior for the application and alert on any deviations. This technique is crucial for detecting post-exploitation activity if an attacker bypasses perimeter defenses, enabling a rapid response to contain the breach before significant data exfiltration or impact occurs.
Timeline of Events
CISA issues Binding Operational Directive (BOD) 26-04, introducing new risk-based patching timelines.
CISA adds seven new vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog.
Patching deadline for most of the newly added KEVs for FCEB agencies.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.