# CISA Adds Seven Known Exploited Vulnerabilities to Catalog: AI Infrastructure, Python Web Frameworks, SonicWall, VoIP, and Artifactory > Source: > Published: 2026-09-03 04:44:34+00:00 ## 1. Basic Information - **Article Title**: CISA Adds Seven Known Exploited Vulnerabilities to Catalog - **Publisher**: CISA - **Publication Date**: 2026-09-02 - **Original Source**: [CISA](https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog) - **Related Sources**: [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), [LiteLLM GHSA-7488-6r32-c95q](https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q), [Starlette GHSA-86qp-5c8j-p5mr](https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr), [Kestra GHSA-5vc5-wxxq-3fjx](https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx), [Horizon3.ai Switchvox analysis](https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/), [SonicWall SNWLID-2026-0016](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016) - **Related Malware, Threat Groups, CVEs, and Products**: CVE-2026-59822, CVE-2026-48710, CVE-2026-49869, CVE-2026-82329, CVE-2026-9586, CVE-2026-83548, CVE-2026-83549, LiteLLM, Starlette, Kestra OSS, JFrog Artifactory, Sangoma Switchvox, SonicWall SMA 1000 - **Severity**: Critical ## 2. Executive Summary CISA has added seven vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog affecting LiteLLM, Starlette, Kestra, JFrog Artifactory, Sangoma Switchvox, and SonicWall SMA 1000. CISA set a short remediation deadline of September 5, 2026, for Kestra, Artifactory, Switchvox, and SonicWall. ## 3. Attack Flow ### Bypassing Authentication Boundaries in AI and Web Infrastructure - An attacker sends a crafted request to a public LiteLLM instance, a service using Starlette, or Kestra. - Flaws in bearer token validation, URL path interpretation, or suffix checks for `/configs` allow the attacker to bypass authentication boundaries. - The attacker utilizes Model Context Protocol (MCP) tools, reaches protected operations, or creates arbitrary workflows. - In Kestra, the attacker uses script execution plugins to run code with root privileges. ### Remote Code Execution via SQL Injection in Switchvox - An attacker sends a crafted XML payload in the PolycomIPPhone format to the unauthenticated `/pa` endpoint. - The `PhoneIP` value is concatenated directly into a PostgreSQL statement without validation. - The attacker abuses PostgreSQL's `PROGRAM` execution feature to launch OS commands. - Observed instances show attackers obtaining an external shell, enumerating running processes, and exfiltrating the data. ### Pre-Authentication SSRF and Management Interface Code Execution in SonicWall - An attacker sends an unauthenticated request to an unintended proxy route in Appliance Workplace. - Server-Side Request Forgery (SSRF) allows the attacker to reach normally protected functions and perform unauthorized actions. - When conditions are met, the attacker exploits command injection in the administrator Appliance Management Console. - The attacker executes arbitrary OS commands on the device, gaining control over the VPN boundary. ### Gaining Administrator Privileges in Artifactory - An unauthenticated attacker reaches a vulnerable Artifactory instance. - The attacker exploits authentication weaknesses to gain administrator privileges. - The attacker creates an administrator token for persistence. - The attacker accesses artifacts, repository configurations, and CI/CD credentials. ## 4. Attacker Position and Execution Location - External attackers who can reach the HTTP or HTTPS interfaces of the target products. - SonicWall CVE-2026-83549 requires administrator authentication on its own, but chaining with pre-authentication SSRF has been reported. ## 5. Visibility for Victims and Administrators ### Victims - Most vulnerabilities do not require user interaction, making compromises difficult to detect through standard user interfaces alone. ### Administrators - Management API, MCP, or workflow operations following authentication failures or unauthenticated requests. - Shells or unknown child processes originating from Java, Python, PostgreSQL, or VPN appliance processes. - New administrator tokens, configuration changes, outbound network traffic, and suspicious SQL queries recorded in `db-quirks.log` on Switchvox. ## 6. Success and Failure Conditions ### Success Conditions - The vulnerable version is reachable by the attacker. - Patches or workarounds are not applied. - Management operations or code execution following authentication bypass are not blocked by additional controls. ### Failure Conditions and Risk Mitigation - Update to the vendor-provided patched version and move external exposure behind a VPN, allowlist, or authentication proxy. - Restrict shell and script launches, token creation, and outbound communication from management planes. - Avoid storing long-lived credentials on management infrastructure; use dedicated, short-lived, least-privilege credentials. ## 7. Impact of Successful Exploitation - Authentication bypass and acquisition of administrator privileges. - Remote code execution with root or product service privileges. - Theft or tampering with API keys, administrator tokens, configurations, artifacts, and communication data. - Lateral movement into internal networks, cloud environments, and development or distribution pipelines. ## 8. Observable Logs - **Email**: None. - **Proxy/SWG/DNS**: Abnormal pre-authentication requests to management interfaces, followed by outbound connections to unknown domains. - **Endpoint/EDR**: Product processes launching `shell` , `script` , `curl` , `nc` , PowerShell, or creating unexpected files. - **Identity/IdP**: New administrator tokens, management authentication from unusual source IPs, and abnormal use of bearer tokens. - **SaaS/Cloud**: MCP tool calls, workflow creation, artifact modifications, and sudden spikes in API key usage. - **Network**: Unknown destinations communicating with management infrastructure, internal reconnaissance, and outbound connections from VPN appliances. ## 9. Attack Success Determination - **Attack Attempt Observed (Success Unconfirmed)**: Confirmed requests to vulnerable entry points, but authentication bypass or child processes were not observed. - **User Action Confirmed**: No user interaction is required. - **Initial Execution Confirmed**: Confirmed unauthenticated MCP or management operations, workflow creation, or SQL execution. - **Malware Execution or Authentication Success Confirmed**: Confirmed use of shells, scripts, administrator tokens, or command execution on the device. - **Data Theft or Session Compromise Confirmed**: Confirmed reading or exfiltration of secrets, artifacts, configurations, or process information. - **Subsequent Compromise Confirmed**: Confirmed internal lateral movement, artifact tampering, or persistence on the VPN boundary. ## 10. Investigation Playbook - **Trigger**: Abnormal pre-authentication requests to KEV-targeted products, creation of administrator tokens, or product processes launching a shell. - **Initial Verification**: Verify the product version, public exposure scope, patch timestamp, and initial source IP per asset. Preserve web, audit, OS, and network logs. - **Endpoints**: Check for child processes of product services, added files, configuration changes, persistence mechanisms, and Switchvox's `db-quirks.log` . - **Authentication & Cloud**: Investigate creation and usage history of API keys, MCP authentication, administrator tokens, service accounts, and VPN administrators. - **Subsequent Activity**: Verify access to secrets, artifact modifications, outbound communication, internal connections, and downstream distribution. - **Containment**: Block external access, update to a patched version, and revoke suspicious tokens and credentials. Rebuild compromised devices with vendor support and inspect downstream artifacts and connections. - **Categorization**: Classify events by product into contact, authentication bypass, code execution, secret theft, and lateral movement/tampering. ## 11. Defense and Detection Ideas - **Single Event**: Unauthenticated sources invoking MCP, management APIs, or workflow creation. Product processes launching `shell` , script interpreters, `curl` , or `nc` . - **Time-Series Correlation**: Correlate pre-authentication requests -> management operations -> token creation or code execution -> secret harvesting -> unknown destination connections. - **Threat Hunting**: Search historically across web, audit, process, token, and outbound network logs for target products, including data prior to CISA's addition date. - **Log Gaps**: Without management API request paths, token creation actors, container internal processes, and device outbound communications, determining the success phase is not possible. - **Priority Actions**: Isolate and patch products with the September 5 deadline as the highest priority, and immediately verify asset exposure for LiteLLM and Starlette (September 16 deadline). ## 12. Facts / Inference / Hypothesis ### Facts - CISA updated the KEV catalog on September 2, 2026, at 16:54 UTC, adding seven vulnerabilities as actively exploited. - LiteLLM CVE-2026-59822 falls back to empty credentials after failed API key verification, allowing any bearer token to establish an MCP Streamable HTTP session. It was fixed in version 1.84.0. - Starlette CVE-2026-48710 features a discrepancy between URL reconstruction using the Host header and actual routing path interpretation, leading to bypasses in configurations where authorization checks rely on `request.url.path` . It was fixed in version 1.0.1. - Kestra CVE-2026-49869 allows unauthenticated flow creation because the authentication filter uses `endsWith` rather than exact matching for `/configs` at the end of the path. This leads to root code execution inside the worker container via default script execution plugins. It was fixed in versions 1.0.45 and 1.3.21. - JFrog Artifactory CVE-2026-82329 allows unauthenticated administrator privilege acquisition in default configurations, and attackers have been reported creating administrator tokens. - Sangoma Switchvox CVE-2026-9586 concatenates the `PhoneIP` parameter from unauthenticated XML payloads sent to `/pa` directly into a PostgreSQL statement without validation, leading to remote code execution via database `PROGRAM` execution. It was fixed in version 8.4.0.2, and active exploitation was observed on August 30. - In SonicWall SMA 1000, CVE-2026-83548 (pre-authentication SSRF) and CVE-2026-83549 (management console OS command injection) are actively exploited. Platform hotfixes starting from versions 12.4.3-03526 and 12.5.0-02952 address these issues. - CISA's remediation deadlines are September 5, 2026, for Kestra, Artifactory, Switchvox, and SonicWall, and September 16, 2026, for LiteLLM and Starlette. ### Inference - Exposing management interfaces for AI, development, remote access, and telephony infrastructure externally makes them prone to widespread compromise affecting secrets, internal networks, and supply chains from a single vulnerability. - Products with the September 5 deadline require simultaneous exposure checks and emergency change management rather than waiting for regular monthly update cycles. ### Hypothesis - No public evidence links the active exploitation of these individual CVEs to a single attacker or campaign. ## 13. MITRE ATT&CK Mapping - **T1190 Exploit Public-Facing Application (High)**: Exploiting vulnerabilities in externally reachable web and management interfaces. - **T1078 Valid Accounts (Medium)**: LiteLLM authentication bypasses and Artifactory administrator tokens lead to the abuse of legitimate authentication paths. - **T1059 Command and Scripting Interpreter (High)**: Kestra script execution, Switchvox PostgreSQL `PROGRAM` , and SonicWall OS command injection lead to code execution. ## 14. Unknowns and Additional Investigations - Number of victim organizations for each vulnerability and threat actor attribution. - Specific subsequent operations observed for LiteLLM and Starlette. - Details of indicators of compromise provided by SonicWall to individual customers. ## 15. Impact on SOCs and General Organizations AI gateways, Python web services, workflow engines, artifact repositories, VoIP, and SSL VPNs serve as high-privilege management surfaces. Organizations should immediately cross-reference asset inventories with vulnerable versions and external exposure, prioritizing the four product groups with the September 5 deadline. For systems exposed prior to patching, administrators must retrospectively check for tokens, child processes, configuration changes, and outbound communications rather than relying solely on applying the software update. ## 16. Summary by Target Audience - **For SOCs**: Cross-reference assets with the seven CVEs, and correlate pre-authentication access followed by management operations, script/shell execution, token creation, and unknown destination traffic. - **For Administrators**: Reduce external exposure and update to patched versions before September 5 for Kestra, Artifactory, Switchvox, and SonicWall, and before September 16 for LiteLLM and Starlette. - **For Users**: Most vulnerabilities require no user action. Report service anomalies or unexpected changes in phone, VPN, or development infrastructure to administrators.