Dateline: September 3, 2026
TL;DR: The bad guys got there first. On Wednesday, the U.S. Cybersecurity and Infrastructure Security Agency dropped seven new entries onto its Known Exploited Vulnerabilities catalog, and every one of them shares the same ugly footnote: attackers are already using them in the wild. This is not a list of what might go wrong. It is a list of what already has. Federal agencies now have days, not weeks, to slam these doors shut. Everyone else should read the same clock.
What Happened?
The seven flaws hit a strange mix of gear. Two land in SonicWall SMA 1000 remote-access appliances, one of them a maximum-severity 10.0 that lets an unauthenticated attacker reach sensitive functions and forge internal requests. A 9.3-rated SQL injection bug in Sangoma Switchvox VoIP systems lets a single crafted request run commands against the backend database. JFrog Artifactory, the software supply-chain repository, carries a 9.8 authentication flaw that hands an outsider admin rights under default settings.
Then come the AI and web pieces. Kestra, a workflow engine, has a perfect 10.0 command-injection hole that lets anyone create and run workflows with no credentials at all. The Starlette Python framework can be tricked into smuggling paths and bypassing authentication. And Berri LiteLLM, a popular AI gateway, has a flaw in its Model Context Protocol endpoint that lets an attacker open an authenticated session using any bearer token they feel like typing.
One exposed console. Then the whole stack.
Across these seven flaws, the path researchers observed looked the same even when the entry point changed. A single public interface became a doorway to secrets and internal networks.
The fix is not just the patch. Pull management interfaces off the public internet, then hunt for the foothold before you assume the patch saved you.
Researchers watched these bugs get weaponized in real time. Reports tied to the Switchvox and Artifactory flaws show attackers dropping reverse shells and minting fake admin tokens to map out users, groups, and access paths. Microsoft traced the Kestra flaw to a late-June intrusion where an attacker opened a reverse shell, poked around a Docker container, and installed a cryptocurrency miner. The LiteLLM chain got even nastier: attackers fingerprinted the host, killed rival miners, dropped their own, and raided the database for AI provider keys and proxy tokens.
What’s the Impact?
AI infrastructure has become a payday. The same telemetry across these cases showed a repeatable pattern: steal credentials, plant durable access, cash out through mining. Attackers went straight for LiteLLM’s token tables to lift upstream provider keys, the kind that unlock expensive model access and backend systems far beyond the box they landed on.
The wider lesson is about exposure. Management consoles for AI, remote access, developer tools, and phone systems keep getting left open to the internet. One weak interface becomes a doorway to secrets, internal networks, and supply chains. And with 5 of these carrying a September 5 federal deadline, waiting for the next monthly patch cycle is not on the table.
CISA KEV: 7 Actively Exploited Flaws
No single unified IOC set exists across these seven CVEs. Use the affected versions as your first exposure filter, then hunt for the post-exploitation behaviors researchers observed. Behavioral detection matters more than static indicators here.
How to Avoid This
Patch the four September 5 items first: SonicWall, Switchvox, Artifactory, and Kestra. The Starlette and LiteLLM flaws follow by September 16. Then do the harder work:
- Pull management interfaces off the public internet. Put them behind a VPN or access control.
- Hunt for compromise before you assume the patch saved you. Check for new SSH keys in authorized_keys files, rogue miner processes, and unexpected outbound traffic.
- Rotate every AI provider key, proxy token, and database credential that touched an exposed LiteLLM or Kestra instance.
- Treat AI gateways as control-plane assets, not just apps. Monitor them like the crown jewels they now are.
