On September 2, 2026, CISA added seven vulnerabilities to its Known Exploited Vulnerabilities catalog. Three of the seven target AI and machine learning infrastructure—the first KEV batch where AI components constitute nearly half the additions.
The three AI-specific CVEs attack distinct layers of the stack. CVE-2026-59822 affects LiteLLM, an AI gateway and proxy. The vulnerability allows an unauthenticated Model Context Protocol session via an arbitrary Bearer token, impacting all versions prior to 1.84.0 with a CVSS score of 8.8. The OAuth2 passthrough fallback replaces failed key validation with an empty auth object, bypassing subsequent authorization checks.
CVE-2026-48710 targets Starlette/FastAPI, the ASGI framework underlying vLLM, LiteLLM, and MCP servers. The “BadHost” vulnerability allows a trivial Host header injection to bypass path-based authentication middleware. A single malformed character in the Host header—/, ?, or #—shifts path boundaries during URL reconstruction, causing request.url.path to differ from the path the router dispatched. CVSS 6.5, but researchers argue the score materially understates real-world risk.
CVE-2026-82329 affects JFrog Artifactory, the artifact repository used in AI/ML pipelines. Under default configuration, a “phantom” join key allows forging administrator tokens. WatchTowr observed in-the-wild exploitation on September 1—four days after disclosure—with attackers minting admin tokens and enumerating users, groups, and credential sets. CVSS 9.8.
The remaining four CVEs address persistent enterprise threats. CVE-2026-49869 in Kestra OSS carries a CVSS 10.0—a suffix-match authentication bypass in AuthenticationFilter that allows any path ending in “/configs” to skip authentication entirely, yielding unauthenticated RCE as root. CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF form a chained zero-day pair for pre-authentication RCE; Huntress confirmed active exploitation since August 26. CVE-2026-83549 in SonicWall SMA1000 is a post-authentication command injection chained with a pre-authentication SSRF, linked to ransomware gang activity.
Remediation timelines are governed by BOD 26-04, which replaced the old 21-day blanket deadline with a risk-based SSVC model. Components face 3-, 14-, or 60-day remediation windows depending on asset exposure, KEV status, exploit automation, and technical impact. Kestra CVE-2026-49869 requires remediation by September 5—three days after its KEV addition.
The inclusion of LiteLLM and Starlette confirms that components central to the MCP ecosystem are being actively targeted in production. Both vulnerabilities expose the same attack surface: how agents authenticate and route requests. Compromise of these layers provides a direct path for attackers to manipulate agentic behavior or exfiltrate sensitive context without touching the model itself.