CISA adds seven actively exploited flaws spanning LiteLLM, Starlette and SonicWall to KEV catalog

What happened

CISA has placed seven vulnerabilities on its Known Exploited Vulnerabilities (KEV) catalog, according to a dev.to summary of the agency's update dated September 2, 2026. The affected products cut across AI infrastructure, Python web frameworks, DevOps tooling, VoIP and VPN appliances: LiteLLM, Starlette, Kestra OSS, JFrog Artifactory, Sangoma Switchvox and SonicWall SMA 1000. The source identifies the flaws as CVE-2026-59822, CVE-2026-48710, CVE-2026-49869, CVE-2026-82329, CVE-2026-9586, CVE-2026-83548 and CVE-2026-83549, and rates the overall set as critical.

According to dev.to, CISA set a September 5, 2026 remediation deadline for four of them — Kestra, Artifactory, Switchvox and the SonicWall flaws. That is roughly three days from publication, a notably short window that matches how urgently the catalog treats confirmed in-the-wild exploitation.

AI infrastructure and Python frameworks

The LiteLLM flaw involves bearer token validation: a crafted request against a publicly reachable instance can bypass the authentication boundary, after which an attacker can invoke Model Context Protocol (MCP) tools and reach protected operations.

Starlette, the Python ASGI framework, mishandles URL path interpretation, letting attackers slip past checks meant to guard protected routes.

Kestra OSS performs improper suffix checks on paths ending in /configs, which again enables an authentication bypass. Attackers can then create arbitrary workflows and, through script execution plugins, run code with root privileges.

Switchvox: SQL injection to operating system commands

In Sangoma's Switchvox VoIP platform, an unauthenticated /pa endpoint accepts XML payloads in the PolycomIPPhone format. The PhoneIP value is concatenated directly into a PostgreSQL statement without validation, and attackers abuse PostgreSQL's PROGRAM execution feature to launch operating system commands. The dev.to write-up, citing a Horizon3.ai analysis, says observed intrusions obtained an external shell, enumerated running processes and exfiltrated data. Suspicious SQL queries recorded in the product's db-quirks.log file are flagged as a useful detection signal.

SonicWall SMA 1000: SSRF chained with command injection

The SonicWall issues begin with a pre-authentication server-side request forgery (SSRF) condition: an unauthenticated request to an unintended proxy route in Appliance Workplace can reach functions that are normally protected. From there, command injection in the administrator Appliance Management Console allows arbitrary OS command execution and control of the VPN boundary. The source notes that CVE-2026-83549 requires administrator authentication on its own, but that chaining it with the pre-auth SSRF has been reported.

Artifactory: admin access without credentials

An unauthenticated attacker who reaches a vulnerable Artifactory instance can exploit authentication weaknesses to gain administrator privileges, mint an administrator token for persistence, and read artifacts, repository configurations and CI/CD credentials.

Detection and hardening

The dev.to analysis points out that most of these flaws require no user interaction, which makes compromise difficult to spot through user-facing interfaces alone. Signals worth monitoring include management API, MCP or workflow operations that follow authentication failures or unauthenticated requests; shells or unknown child processes spawned from Java, Python, PostgreSQL or VPN appliance processes; new administrator tokens; configuration changes; and outbound connections to unknown domains.

The success conditions are simple: a reachable, unpatched version with no compensating controls. Recommended mitigations are to apply vendor patches, move externally exposed management planes behind a VPN, allowlist or authentication proxy, restrict shell and script launches and token creation on management infrastructure, and replace long-lived credentials with short-lived, least-privilege ones.

Why it matters

A KEV listing means the flaws are considered actively exploited, and this batch spans the modern stack end to end: AI gateways and their MCP surface (LiteLLM), a widely used Python web framework (Starlette), workflow orchestration (Kestra), artifact storage at the heart of CI/CD (Artifactory), and perimeter devices (Switchvox and SonicWall). The consequences range from authentication bypass and root-level code execution to theft of API keys, admin tokens and pipeline credentials, followed by lateral movement into internal networks, cloud environments and development pipelines. With a three-day remediation deadline on the worst of them, anyone running these products should verify versions and external exposure immediately.