CISA Adds Seven Known Exploited Vulnerabilities to Catalog
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA1000 SSRF and command injection flaws.
CISA added seven vulnerabilities with evidence of active exploitation to its Known Exploited Vulnerabilities catalog on September 2, 2026. The additions cover Sangoma Switchvox SQL injection (CVE-2026-9586), Kludex Starlette request smuggling (CVE-2026-48710), Kestra OS command injection (CVE-2026-49869), BerriAI LiteLLM (CVE-2026-59822) and JFrog Artifactory (CVE-2026-82329) authentication flaws, and SonicWall SMA1000 SSRF (CVE-2026-83548) and command injection (CVE-2026-83549) vulnerabilities. Under BOD 26-04, federal civilian agencies must prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets.
- Two SonicWall SMA1000 flaws (SSRF, command injection) show active exploitation of edge appliances.
- Authentication flaws in BerriAI LiteLLM and JFrog Artifactory added to KEV.
- BOD 26-04 requires federal civilian agencies to prioritize rapid KEV remediation.
- Other additions: Sangoma Switchvox SQL injection, Starlette request smuggling, Kestra command injection.
- CVEs
- CVE-2026-9586CVE-2026-48710CVE-2026-49869CVE-2026-59822CVE-2026-82329CVE-2026-83548CVE-2026-83549
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-48710 | HTTP Request Smuggling in Kludex Starlette (CVE-2026-48710) | 6.5 | 70% | KEVPoC ×3 | KEV |
| CVE-2026-49869 | Authentication bypass leading to unauthenticated RCE in Kestra OSS | 10.0 | 2% | KEVPoC ×2 | KEV |
| CVE-2026-59822 | Unauthenticated MCP Endpoint Authentication Bypass in BerriAI LiteLLM | 8.8 | <1% | KEV | KEV |
| CVE-2026-82329 | Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access | 9.8 | 14% | KEVPoC ×2 | KEV |
CVE-2026-83548+1 related CVE | Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface | 10.0 group max | 8% | KEVPoC ×3 | KEV |
| CVE-2026-9586 | Unauthenticated SQL Injection RCE in Sangoma Switchvox SMB Edition | 9.3 | 19% | KEVPoC | KEV |
From the original article
1 min read at cisa.govCISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.