7 Alarming CISA Exploited Vulnerabilities: Sept 2026

On September 2, 2026, CISA added seven alarming actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, warning that attackers are already deploying reverse shells and crypto miners against unpatched systems. The batch includes two SonicWall SMA1000 zero-days, a LiteLLM AI gateway authentication bypass, and critical flaws in JFrog Artifactory, Kestra, Starlette, and Sangoma Switchvox.

This September 2026 cybersecurity news roundup breaks down every flaw, the real-world attack patterns observed by researchers, and the concrete steps your organization must take now. If you manage edge appliances, AI infrastructure, or DevOps pipelines, these KEV catalog entries demand immediate attention.

What CISA Added to the KEV Catalog in September 2026

The CISA exploited vulnerabilities announced on September 2, 2026, span an unusually broad range of enterprise software. From network perimeter appliances to AI orchestration platforms and CI/CD pipelines, no layer of the modern stack was spared. CISA added all seven to its KEV catalog based on confirmed evidence of active exploitation in the wild.

The full list of KEV catalog additions includes CVE-2026-9586 (Sangoma Switchvox SQL injection), CVE-2026-48710 (Kludex Starlette HTTP request smuggling), CVE-2026-49869 (Kestra OSS command injection), CVE-2026-59822 (BerriAI LiteLLM improper authentication), CVE-2026-82329 (JFrog Artifactory improper authentication), and two SonicWall SMA1000 flaws: CVE-2026-83548 and CVE-2026-83549.

Each of these actively exploited flaws carries significant risk. Several allow unauthenticated remote attackers to execute code, mint administrative tokens, or pivot into internal networks. The diversity of affected products signals that threat actors are casting a wide net and chaining flaws across the attack surface.

For deeper context on how this fits into the broader threat landscape, see our earlier cybersecurity news roundup from April 2026, which documented a similar wave of actively exploited flaws.

Why the KEV Catalog Matters for Every Organization

The CISA KEV catalog is not just a government compliance tool. While Binding Operational Directive 26-04 requires federal agencies to remediate listed flaws, CISA explicitly urges all organizations to treat KEV entries as priority patches. The catalog is effectively a hit list of vulnerabilities that attackers have already weaponized.

Private-sector companies that ignore CISA exploited vulnerabilities do so at their peril. Threat actors routinely scan the internet for unpatched systems within hours of a KEV catalog update. Organizations that delay patching become low-hanging fruit for ransomware crews, crypto-mining operators, and state-sponsored groups alike.

SonicWall SMA1000 Zero-Days: CVSS 10.0 SSRF and RCE

The most severe of the September 2026 CISA exploited vulnerabilities are two SonicWall SMA1000 zero-days. CVE-2026-83548 is a pre-authentication server-side request forgery flaw rated CVSS 10.0, the maximum possible score. CVE-2026-83549 is a post-authentication OS command injection vulnerability rated CVSS 7.8. Rapid7 confirmed that attackers can chain both bugs to achieve unauthenticated remote code execution.

The SSRF flaw resides in the SMA 1000 Appliance Work Place interface, the user-facing portal for remote access. SonicWall’s security advisory explains that an unintended alternate access path allows remote unauthenticated attackers to gain unauthorized access to sensitive functionality and perform unauthorized operations.

The command injection flaw sits in the SMA 1000 Appliance Management Console. Although it requires authentication, chaining it with the CVSS 10.0 SSRF eliminates that requirement entirely. Once combined, an external attacker can execute arbitrary operating system commands on the appliance without any credentials whatsoever.

Affected Models and Required Firmware Updates

SonicWall confirmed that SMA 1000 models 6210, 7210, and 8200v are affected. Specifically, versions 12.4.3-03453 and 12.5.0-02835 and older carry the vulnerabilities. Customers must upgrade to firmware 12.4.3-03526 or 12.5.0-02952 immediately. SonicWall stated that the attacks are ongoing and urged all customers to install the fixed firmware without delay.

If indicators of compromise are detected, SonicWall recommends re-imaging hardware appliances or re-deploying virtual appliances, changing all user and administrator passwords, and resetting TOTP tokens. This guidance underscores how deeply an attacker can embed once these CISA exploited vulnerabilities are leveraged.

Remote access gateways sit at the network edge and are frequently exposed directly to the internet, making them irresistible targets. Our analysis of Windows shell vulnerabilities from April 2026 highlighted a similar pattern of edge-device exploitation.

Connection to Earlier Summer Attacks

These September zero-days follow attacks on two other SonicWall SMA1000 flaws earlier in the summer. CVE-2026-15409 and CVE-2026-15410 were exploited since June 22, 2026, weeks before patches were released. Cybersecurity firm Volexity attributed that earlier campaign to a threat actor tracked as UTA0533, which deployed custom malware called KnuckleBall.

KnuckleBall injected two tools into legitimate processes: a tailored Java webshell named OrangeTail and an open-source proxy called Suo5. Volexity noted that the attack pattern appeared more consistent with state-sponsored APT activity than profit-driven cybercrime. With root access, the threat actor could capture credentials and intercept network traffic traversing the appliance.

The fact that SonicWall appliances have now been hit by two separate zero-day clusters in a single quarter is deeply concerning. It suggests that these edge devices are becoming a preferred entry point for both nation-state and criminal operators. The CISA exploited vulnerabilities catalog now includes 17 flaws affecting SonicWall products alone.

LiteLLM AI Gateway Authentication Bypass Explained

Among the September 2026 CISA exploited vulnerabilities, CVE-2026-59822 stands out because it targets the AI infrastructure stack. LiteLLM, an open-source AI gateway and proxy server by BerriAI, is widely used to route requests to large language model APIs. The flaw carries a CVSS 4.0 score of 8.8 and affects all versions prior to 1.84.0.

The vulnerability resides in LiteLLM’s MCP Streamable HTTP endpoint. According to the NIST National Vulnerability Database, the endpoint’s authentication handler contains a fallback code path designed for OAuth2 passthrough to upstream MCP servers. When LiteLLM key validation fails, this fallback improperly substitutes an empty UserAPIKeyAuth object rather than terminating the request.

An attacker simply supplies any fabricated Bearer token in the Authorization header. No valid LiteLLM API key, no account credentials, and no prior access are required. The attack is fully remote, operates over the network, and requires no user interaction. This makes it a textbook AI gateway vulnerability with severe implications.

What Attackers Can Access Through the Bypass

Successful exploitation allows unauthorized requests to reach MCP tooling and all connected backend services. The CVSS confidentiality impact is rated High, meaning sensitive data exposed through MCP tools becomes accessible. This includes upstream LLM API keys, model outputs, and backend service credentials stored behind the gateway.

In practice, an attacker who exploits this LiteLLM authentication bypass can effectively impersonate the gateway, call any connected LLM provider, and extract API keys that may grant access to expensive cloud AI services. The financial and data-security implications are enormous, especially for organizations running production AI workloads.

The fix, tracked in GitHub Pull Request 26463, ensures the OAuth2 passthrough fallback validates supplied tokens instead of substituting an empty authentication object. Organizations must upgrade to LiteLLM version 1.84.0 or later and rotate any API keys and downstream provider credentials that may have been exposed.

The Broader AI Security Threat Landscape

This LiteLLM flaw is part of a troubling trend of AI gateway vulnerability disclosures throughout 2026. As enterprises race to deploy LLM-powered applications, the infrastructure connecting those applications to model providers has become a new attack surface. Attackers recognize that AI gateways often hold privileged credentials for multiple cloud services simultaneously.

The Cloud Security Alliance published research noting that Starlette, the web framework underlying many AI platforms including FastAPI and vLLM, must also be updated. Without a Starlette upgrade, a related Host header authentication bypass remains exploitable, and the full unauthenticated chain stays available even against patched LiteLLM code.

For organizations building AI infrastructure, adopting zero trust security strategies that enforce per-request identity verification at every layer is no longer optional. AI gateways must not become the soft underbelly of your security posture.

JFrog Artifactory and Kestra OSS Exploitation

Two more KEV catalog entries target the DevOps and CI/CD pipeline layer. CVE-2026-82329 is an improper authentication vulnerability in JFrog Artifactory, the widely used binary repository manager. CVE-2026-49869 is an OS command injection vulnerability in Kestra OSS, an open-source orchestration platform. Both are being actively exploited in the wild.

JFrog Artifactory sits at the heart of many software supply chains, storing build artifacts, container images, and deployment packages. An authentication bypass in this system could allow attackers to inject malicious artifacts into trusted repositories, potentially compromising every downstream consumer of those artifacts. This is a supply chain attack vector of the highest order.

Kestra OSS command injection is equally dangerous. As an orchestration platform that executes workflows and scripts, command injection flaws can give attackers direct code execution on the infrastructure running Kestra. Researchers observed attackers using this access to deploy reverse shells and establish persistent footholds.

Supply Chain Risk Amplification

The combination of Artifactory and Kestra exploitation is particularly alarming for DevOps teams. If an attacker compromises an Artifactory instance, they can tamper with artifacts that Kestra then orchestrates and deploys. This creates a chained attack path where a single authentication bypass cascades into widespread code execution across the deployment pipeline.

Our previous coverage of the Microsoft Patch Tuesday June 2026 updates highlighted the growing trend of supply chain attacks. These CISA exploited vulnerabilities reinforce that DevOps tooling remains a prime target for adversaries seeking to maximize blast radius.

Security teams should audit all Artifactory and Kestra deployments for exposure, verify that authentication is properly enforced on all endpoints, and review access logs for signs of unauthorized artifact modification or workflow tampering. Any suspicious activity warrants immediate credential rotation and forensic investigation.

Starlette HTTP Smuggling and Switchvox SQL Injection

The remaining KEV catalog entries round out the September batch with a web framework flaw and a telephony system weakness. CVE-2026-48710 is an HTTP request and response smuggling vulnerability in Kludex Starlette, the ASGI framework that powers FastAPI and many Python web applications. CVE-2026-9586 is a SQL injection vulnerability in Sangoma Switchvox, a popular IP phone system.

HTTP request smuggling attacks exploit inconsistencies in how front-end and back-end systems parse HTTP requests. Attackers can craft ambiguous requests that bypass security controls, access restricted endpoints, or poison web caches. Starlette is embedded in thousands of AI and web applications, making this flaw’s impact potentially enormous across the Python ecosystem. These reverse shell attacks and smuggling techniques share a common theme of exploiting trust boundaries.

The Switchvox SQL injection vulnerability is more targeted but equally serious. IP phone systems often contain sensitive call records, voicemail data, and internal directory information. SQL injection can allow attackers to extract this data, modify call routing, or pivot into internal networks that the phone system can reach.

Starlette’s outsized Ripple Effect

Starlette deserves special attention because of its deep integration into the Python and AI development ecosystem. FastAPI, one of the most popular Python web frameworks, is built directly on Starlette. Any FastAPI application that has not updated its Starlette dependency may be vulnerable to request smuggling attacks.

The Cloud Security Alliance specifically warned that any service built on FastAPI, vLLM, or other Starlette-based frameworks should be assessed and upgraded. The BadHost authentication bypass condition can be combined with the LiteLLM flaw to create a full unauthenticated exploitation chain against AI platforms. This makes the Starlette update a prerequisite for meaningful remediation.

Organizations should inventory all Python web services, identify Starlette versions, and upgrade to version 1.0.1 or later. This must happen in the same remediation cycle as the LiteLLM patch, because without it, the authentication bypass remains available even on patched LiteLLM deployments.

Attack Patterns: Reverse Shells and Crypto Miners

What makes these actively exploited flaws especially urgent is the evidence of what attackers are doing with them. According to reporting from The Hacker News, threat actors are deploying reverse shells and cryptocurrency miners on compromised systems. Reverse shells give attackers interactive command-line access to victim machines, enabling data theft, lateral movement, and persistence.

Crypto mining malware, while sometimes considered less destructive than ransomware, consumes CPU and GPU resources, degrades system performance, and generates unauthorized cloud compute charges. In AI infrastructure environments, where GPU resources are expensive and scarce, crypto-mining infections can cause significant financial damage and disrupt critical ML workloads.

The deployment of reverse shells indicates that attackers are not merely probing these systems opportunistically. They are establishing interactive sessions, exploring the compromised environment, and preparing for deeper intrusion. This level of engagement suggests organized threat groups rather than automated scan-and-exploit bots.

The SonicWall KnuckleBall Malware Connection

In the earlier summer SonicWall attacks, Volexity documented the deployment of custom malware called KnuckleBall. This malware injected a Java webshell named OrangeTail and an open-source proxy tool called Suo5 into legitimate processes on the appliance. The webshell provided persistent backdoor access, while the proxy tool enabled traffic tunneling deeper into the network.

Although the current September SonicWall zero-days have not yet been linked to UTA0533, the attack pattern is likely similar. Edge appliances that fall to CISA exploited vulnerabilities become staging points for credential harvesting, traffic interception, and lateral movement into the corporate network behind them.

Volexity noted that while UTA0533 demonstrated significant capability in compromising SonicWall appliances, the group was less successful moving laterally. This silver lining should not breed complacency, however, because subsequent attackers may be more skilled at internal pivoting once they gain that initial foothold.

How to Protect Your Organization Now

Addressing these September KEV additions requires a prioritized, risk-based approach. Start by identifying every instance of affected software in your environment. Use asset inventories, network scans, and cloud resource listings to build a complete picture of exposure. You cannot patch what you cannot see.

For SonicWall SMA1000 appliances, upgrade firmware to version 12.4.3-03526 or 12.5.0-02952 immediately. Review logs for indicators of compromise, including unexpected outbound connections, unfamiliar processes, and modified system files. If IOCs are found, re-image the appliance, change all passwords, and reset TOTP tokens.

For LiteLLM, upgrade to version 1.84.0 or later and rotate all API keys and downstream provider credentials. Simultaneously update Starlette to version 1.0.1 or later in every FastAPI or vLLM service. These updates must be coordinated, because the Starlette bypass undermines the LiteLLM fix if left unpatched.

Implement Continuous Vulnerability Management

Reactive patching after a CISA alert is necessary but insufficient. Organizations must implement continuous vulnerability management programs that monitor for new KEV catalog entries and automatically prioritize remediation. The CISA BOD 26-04 guidance provides an excellent framework for risk-based prioritization that any organization can adopt.

Risk-based vulnerability management means focusing remediation efforts on flaws that are both exploitable and present on publicly exposed assets. Not every vulnerability deserves the same urgency. CISA exploited vulnerabilities, by definition, have confirmed active exploitation and should always jump to the top of the remediation queue.

For evaluating security tools that can help automate this process, see our review of the best cybersecurity tools for 2026. Vulnerability scanners, attack surface management platforms, and threat intelligence feeds all play critical roles in staying ahead of the KEV catalog.

Strengthen Edge Device and AI Infrastructure Defenses

Edge appliances like SonicWall SMA1000 gateways deserve special defensive attention. Where possible, restrict management interfaces to internal networks or VPN-only access. Deploy network detection and response sensors to monitor for anomalous traffic patterns originating from edge devices. Implement log forwarding so appliance logs land in a central SIEM for correlation and alerting.

For AI infrastructure, enforce strict network segmentation between AI gateways and backend services. Apply the principle of least privilege to API keys stored in gateways like LiteLLM. Monitor API call patterns for anomalies that could indicate unauthorized access through an authentication bypass. Consider implementing rate limiting and behavioral analytics on AI gateway endpoints.

Finally, ensure that your incident response plan includes specific playbooks for edge device compromise and AI gateway breaches. These scenarios require different containment and eradication steps than traditional endpoint infections. Practicing these playbooks through tabletop exercises will save critical time during a real incident.

Key Takeaways for September 2026 Cybersecurity

The September 2026 CISA exploited vulnerabilities batch delivers several clear lessons. First, edge appliances remain a top attack vector. SonicWall SMA1000 devices have now been hit by two separate zero-day clusters in one quarter, proving that network perimeter devices are high-value targets for both state-sponsored and criminal actors.

Second, AI infrastructure is a new and growing attack surface. The LiteLLM authentication bypass demonstrates that the tools organizations use to manage LLM API access can themselves be compromised. As AI adoption accelerates, expect more CISA exploited vulnerabilities targeting AI gateways, model serving platforms, and orchestration frameworks.

Third, DevOps tooling remains critical to secure. The JFrog Artifactory and Kestra OSS flaws show that CI/CD pipelines are not just development tools but security-critical infrastructure. A compromise here can cascade through the entire software supply chain, affecting every downstream consumer.

Final Recommendations

Treat every KEV catalog update as an emergency patching cycle, not a routine task. The seven CISA exploited vulnerabilities added on September 2, 2026, are all confirmed to be under active attack. Delaying remediation means betting that attackers will not find your exposed systems before you patch them, and that is a bet you will eventually lose.

For ongoing coverage of cybersecurity threats and vulnerabilities, bookmark our cybersecurity stories coverage and check back regularly. The threat landscape evolves daily, and staying informed is your first line of defense against the next wave of CISA exploited vulnerabilities.

Remember: the difference between a patched system and a breach often comes down to hours, not days. When CISA confirms active exploitation, the clock is already ticking. Act now, document your remediation, and verify that patches are effective through post-deployment testing.