CISA Adds Seven Known Exploited Vulnerabilities to Catalog: AI Infrastructure, Python Web Frameworks, SonicWall, VoIP, and Artifactory

wpnews.pro

Article Title: CISA Adds Seven Known Exploited Vulnerabilities to Catalog #

Publisher: CISA #

Publication Date: 2026-09-02 #

Original Source: CISA #

Severity: Critical

CISA has added seven vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog affecting LiteLLM, Starlette, Kestra, JFrog Artifactory, Sangoma Switchvox, and SonicWall SMA 1000. CISA set a short remediation deadline of September 5, 2026, for Kestra, Artifactory, Switchvox, and SonicWall.

#

Attack Flow

Bypassing Authentication Boundaries in AI and Web Infrastructure

An attacker sends a crafted request to a public LiteLLM instance, a service using Starlette, or Kestra.
Flaws in bearer token validation, URL path interpretation, or suffix checks for /configs

allow the attacker to bypass authentication boundaries.

The attacker utilizes Model Context Protocol (MCP) tools, reaches protected operations, or creates arbitrary workflows.
In Kestra, the attacker uses script execution plugins to run code with root privileges.

Remote Code Execution via SQL Injection in Switchvox

An attacker sends a crafted XML payload in the PolycomIPPhone format to the unauthenticated /pa

endpoint.

The PhoneIP

value is concatenated directly into a PostgreSQL statement without validation.

The attacker abuses PostgreSQL's PROGRAM

execution feature to launch OS commands.

Observed instances show attackers obtaining an external shell, enumerating running processes, and exfiltrating the data.

Pre-Authentication SSRF and Management Interface Code Execution in SonicWall

An attacker sends an unauthenticated request to an unintended proxy route in Appliance Workplace.
Server-Side Request Forgery (SSRF) allows the attacker to reach normally protected functions and perform unauthorized actions.
When conditions are met, the attacker exploits command injection in the administrator Appliance Management Console.
The attacker executes arbitrary OS commands on the device, gaining control over the VPN boundary.

Gaining Administrator Privileges in Artifactory

An unauthenticated attacker reaches a vulnerable Artifactory instance.
The attacker exploits authentication weaknesses to gain administrator privileges.
The attacker creates an administrator token for persistence.
The attacker accesses artifacts, repository configurations, and CI/CD credentials.

#

Attacker Position and Execution Location

External attackers who can reach the HTTP or HTTPS interfaces of the target products.
SonicWall CVE-2026-83549 requires administrator authentication on its own, but chaining with pre-authentication SSRF has been reported.

#

Visibility for Victims and Administrators

Victims

Most vulnerabilities do not require user interaction, making compromises difficult to detect through standard user interfaces alone.

Administrators

Management API, MCP, or workflow operations following authentication failures or unauthenticated requests.
Shells or unknown child processes originating from Java, Python, PostgreSQL, or VPN appliance processes.
New administrator tokens, configuration changes, outbound network traffic, and suspicious SQL queries recorded in db-quirks.log

on Switchvox.

#

Success and Failure Conditions

Success Conditions

The vulnerable version is reachable by the attacker.
Patches or workarounds are not applied.
Management operations or code execution following authentication bypass are not blocked by additional controls.

Failure Conditions and Risk Mitigation

Update to the vendor-provided patched version and move external exposure behind a VPN, allowlist, or authentication proxy.
Restrict shell and script launches, token creation, and outbound communication from management planes.
Avoid storing long-lived credentials on management infrastructure; use dedicated, short-lived, least-privilege credentials.

#

Impact of Successful Exploitation

Authentication bypass and acquisition of administrator privileges.
Remote code execution with root or product service privileges.
Theft or tampering with API keys, administrator tokens, configurations, artifacts, and communication data.
Lateral movement into internal networks, cloud environments, and development or distribution pipelines.

#

Observable Logs

Email: None. #

Proxy/SWG/DNS: Abnormal pre-authentication requests to management interfaces, followed by outbound connections to unknown domains. #

Endpoint/EDR: Product processes launching shell

, script

, curl

, nc

, PowerShell, or creating unexpected files. #

Identity/IdP: New administrator tokens, management authentication from unusual source IPs, and abnormal use of bearer tokens. #

SaaS/Cloud: MCP tool calls, workflow creation, artifact modifications, and sudden spikes in API key usage. #

Network: Unknown destinations communicating with management infrastructure, internal reconnaissance, and outbound connections from VPN appliances.

#

Attack Success Determination

Attack Attempt Observed (Success Unconfirmed): Confirmed requests to vulnerable entry points, but authentication bypass or child processes were not observed. #

User Action Confirmed: No user interaction is required. #

Initial Execution Confirmed: Confirmed unauthenticated MCP or management operations, workflow creation, or SQL execution. #

Malware Execution or Authentication Success Confirmed: Confirmed use of shells, scripts, administrator tokens, or command execution on the device. #

Data Theft or Session Compromise Confirmed: Confirmed reading or exfiltration of secrets, artifacts, configurations, or process information. #

Subsequent Compromise Confirmed: Confirmed internal lateral movement, artifact tampering, or persistence on the VPN boundary.

#

Investigation Playbook

Trigger: Abnormal pre-authentication requests to KEV-targeted products, creation of administrator tokens, or product processes launching a shell. #

Initial Verification: Verify the product version, public exposure scope, patch timestamp, and initial source IP per asset. Preserve web, audit, OS, and network logs. #

Endpoints: Check for child processes of product services, added files, configuration changes, persistence mechanisms, and Switchvox's db-quirks.log

. #

Authentication & Cloud: Investigate creation and usage history of API keys, MCP authentication, administrator tokens, service accounts, and VPN administrators. #

Subsequent Activity: Verify access to secrets, artifact modifications, outbound communication, internal connections, and downstream distribution. #

Containment: Block external access, update to a patched version, and revoke suspicious tokens and credentials. Rebuild compromised devices with vendor support and inspect downstream artifacts and connections. #

Categorization: Classify events by product into contact, authentication bypass, code execution, secret theft, and lateral movement/tampering.

#

Defense and Detection Ideas

Single Event: Unauthenticated sources invoking MCP, management APIs, or workflow creation. Product processes launching shell

, script interpreters, curl

, or nc

. #

Time-Series Correlation: Correlate pre-authentication requests -> management operations -> token creation or code execution -> secret harvesting -> unknown destination connections. #

Threat Hunting: Search historically across web, audit, process, token, and outbound network logs for target products, including data prior to CISA's addition date. #

Log Gaps: Without management API request paths, token creation actors, container internal processes, and device outbound communications, determining the success phase is not possible. #

Priority Actions: Isolate and patch products with the September 5 deadline as the highest priority, and immediately verify asset exposure for LiteLLM and Starlette (September 16 deadline).

#

Facts / Inference / Hypothesis

Facts

CISA updated the KEV catalog on September 2, 2026, at 16:54 UTC, adding seven vulnerabilities as actively exploited.
LiteLLM CVE-2026-59822 falls back to empty credentials after failed API key verification, allowing any bearer token to establish an MCP Streamable HTTP session. It was fixed in version 1.84.0.
Starlette CVE-2026-48710 features a discrepancy between URL reconstruction using the Host header and actual routing path interpretation, leading to bypasses in configurations where authorization checks rely on request.url.path

. It was fixed in version 1.0.1.

Kestra CVE-2026-49869 allows unauthenticated flow creation because the authentication filter uses endsWith

rather than exact matching for /configs

at the end of the path. This leads to root code execution inside the worker container via default script execution plugins. It was fixed in versions 1.0.45 and 1.3.21.

JFrog Artifactory CVE-2026-82329 allows unauthenticated administrator privilege acquisition in default configurations, and attackers have been reported creating administrator tokens.
Sangoma Switchvox CVE-2026-9586 concatenates the PhoneIP

parameter from unauthenticated XML payloads sent to /pa

directly into a PostgreSQL statement without validation, leading to remote code execution via database PROGRAM

execution. It was fixed in version 8.4.0.2, and active exploitation was observed on August 30.

In SonicWall SMA 1000, CVE-2026-83548 (pre-authentication SSRF) and CVE-2026-83549 (management console OS command injection) are actively exploited. Platform hotfixes starting from versions 12.4.3-03526 and 12.5.0-02952 address these issues.
CISA's remediation deadlines are September 5, 2026, for Kestra, Artifactory, Switchvox, and SonicWall, and September 16, 2026, for LiteLLM and Starlette.

Inference

Exposing management interfaces for AI, development, remote access, and telephony infrastructure externally makes them prone to widespread compromise affecting secrets, internal networks, and supply chains from a single vulnerability.
Products with the September 5 deadline require simultaneous exposure checks and emergency change management rather than waiting for regular monthly update cycles.

Hypothesis

No public evidence links the active exploitation of these individual CVEs to a single attacker or campaign.

#

MITRE ATT&CK Mapping

T1190 Exploit Public-Facing Application (High): Exploiting vulnerabilities in externally reachable web and management interfaces. #

T1078 Valid Accounts (Medium): LiteLLM authentication bypasses and Artifactory administrator tokens lead to the abuse of legitimate authentication paths. #

T1059 Command and Scripting Interpreter (High): Kestra script execution, Switchvox PostgreSQL PROGRAM

, and SonicWall OS command injection lead to code execution.

#

Unknowns and Additional Investigations

Number of victim organizations for each vulnerability and threat actor attribution.
Specific subsequent operations observed for LiteLLM and Starlette.
Details of indicators of compromise provided by SonicWall to individual customers.

#

Impact on SOCs and General Organizations

AI gateways, Python web services, workflow engines, artifact repositories, VoIP, and SSL VPNs serve as high-privilege management surfaces. Organizations should immediately cross-reference asset inventories with vulnerable versions and external exposure, prioritizing the four product groups with the September 5 deadline. For systems exposed prior to patching, administrators must retrospectively check for tokens, child processes, configuration changes, and outbound communications rather than relying solely on applying the software update.

#

Summary by Target Audience

For SOCs: Cross-reference assets with the seven CVEs, and correlate pre-authentication access followed by management operations, script/shell execution, token creation, and unknown destination traffic. #

For Administrators: Reduce external exposure and update to patched versions before September 5 for Kestra, Artifactory, Switchvox, and SonicWall, and before September 16 for LiteLLM and Starlette. #

For Users: Most vulnerabilities require no user action. Report service anomalies or unexpected changes in phone, VPN, or development infrastructure to administrators.

source & further reading

dev.to — original article Debrief is not a PDF chatbot — it recovers decisions with citations Context Engineering: Why Your AI Agent Needs a Database, Not a Prompt I stopped writing prompts. I write the repo.