CISA Adds Seven Actively Exploited Flaws to KEV — Shells and Miners Follow
A fresh CISA KEV batch spans SonicWall, Sangoma, JFrog, Kestra and LiteLLM — and in several cases the exploitation has already moved past initial access to reverse shells and cryptomining.
Key Takeaways
- On 2 September 2026, CISA added seven actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, spanning SonicWall SMA 1000, Sangoma Switchvox, JFrog Artifactory, Kludex Starlette, Kestra OSS, and BerriAI LiteLLM.
- Attackers are chaining a Sangoma SQL injection and a JFrog Artifactory auth bypass into reverse shells and freshly minted admin tokens for follow-on access.
- A maximum-severity Kestra OS command injection bug (CVSS 10.0) has been observed leading to both a reverse shell and cryptocurrency miner deployment on compromised hosts.
- Federal civilian agencies face remediation deadlines of 5 September (five of the flaws) and 16 September 2026 (Starlette and LiteLLM) under Binding Operational Directive 26-04 — any organization running this software should treat those dates as a floor, not a target.
Seven additions, one common trigger: active exploitation
CISA added seven vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on 2 September 2026, per CISA's advisory. The mix is notable: perimeter VPN appliances, a VoIP PBX, a DevOps artifact registry, a Python web framework, and two pieces of AI/agent tooling. Every entry is on the list for the same reason — CISA has evidence it is already being exploited in the wild, not that a researcher merely disclosed it.
- SonicWall SMA 1000 — CVE-2026-83548, server-side request forgery (CVSS 10.0), and CVE-2026-83549, OS command injection (CVSS 7.8)
- Sangoma Switchvox — CVE-2026-9586, SQL injection (CVSS 9.3)
- JFrog Artifactory — CVE-2026-82329, authentication bypass allowing unauthenticated attackers to obtain admin privileges under default configuration (CVSS 9.8)
- Kludex Starlette — CVE-2026-48710, HTTP request/response smuggling enabling auth bypass (CVSS 6.5)
- Kestra OSS — CVE-2026-49869, OS command injection allowing unauthenticated workflow execution (CVSS 10.0)
- BerriAI LiteLLM — CVE-2026-59822, authentication bypass in its Model Context Protocol (MCP) endpoint, allowing arbitrary bearer tokens (CVSS 8.8)
From bypass to reverse shell to miner
Per The Hacker News, unidentified threat actors have weaponized the Sangoma and JFrog flaws to deploy reverse shells and mint rogue administrator tokens for follow-on enumeration — in Artifactory's case, that persistence has reportedly extended to pulling artifacts, repository configuration, and CI/CD credentials. Kestra's command-injection bug has gone further still: reporting cited in the same article attributes to Microsoft the observation that compromises exposed four separate impact paths, including shell execution through the workflow engine itself and cryptocurrency miner deployment via host resource hijacking.
The Starlette and LiteLLM entries round out a distinct thread. LiteLLM's MCP endpoint bug lets an attacker forge an Authorization header to obtain an authenticated session without a valid key — a class of bug that matters more as organizations wire LLM agents and MCP servers directly into internal systems and credential stores.
Why this keeps landing on edge and AI infrastructure
Six of the seven products sit at a trust boundary: an SSL-VPN gateway, a PBX admin interface, an artifact registry that holds CI/CD secrets, and an AI agent/workflow platform reachable by design. Authentication-bypass and injection bugs in software like this are disproportionately valuable to attackers because a single flaw converts directly into credentials, code execution, or both — and KEV additions consistently skew toward exactly this category of internet-facing, admin-adjacent software rather than client-side bugs.
What the deadline actually means
Under Binding Operational Directive 26-04, US federal civilian agencies must remediate the SonicWall, Sangoma, JFrog, and Kestra flaws by 5 September 2026, and the Starlette and LiteLLM flaws by 16 September 2026. Those dates bind federal agencies specifically, but KEV listing is a reliable signal that exploitation is already underway against anyone running the affected software — private-sector teams with exposed instances of any of these products should not wait for a compliance deadline to act.
- Inventory internet-facing SonicWall SMA 1000, Switchvox, Artifactory, Kestra, and LiteLLM/Starlette-based deployments and patch to vendor-fixed versions immediately
- Hunt for indicators already described publicly: unexpected admin/API tokens, unfamiliar reverse-shell processes, and unauthorized cryptominer binaries or scheduled tasks on hosts running the affected software
- Rotate credentials and API keys reachable from any instance that was internet-exposed and unpatched during the exploitation window
- For MCP/agent-facing services like LiteLLM, treat authentication on tool-calling endpoints as a first-class attack surface, not an afterthought
FAQ
Frequently Asked Questions
What does it mean when CISA adds a flaw to the KEV catalog?
It means CISA has confirmed evidence of real-world exploitation, not just a theoretical risk — KEV listings drive mandatory patch deadlines for US federal agencies and serve as a reliable priority signal for everyone else.
Are these seven vulnerabilities only a concern for US federal agencies?
No. The BOD 26-04 deadlines (5 and 16 September 2026) legally bind federal civilian agencies, but the underlying exploitation — reverse shells, minted admin tokens, and cryptominer deployment — targets any organization running unpatched SonicWall, Sangoma, JFrog, Kestra, Starlette, or LiteLLM instances.
Why are AI-related tools like Kestra and LiteLLM showing up in KEV alongside traditional network appliances?
Workflow engines and LLM/agent platforms increasingly sit at the same trust boundary as VPNs and artifact registries — they're internet-reachable, hold credentials, and can execute code — so authentication-bypass and injection bugs in them are exploited the same way perimeter software bugs always have been.