On September 2, 2026, CISA added seven vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog, confirming their active exploitation. Affected products include SonicWall SMA 1000, Sangoma Switchvox, JFrog Artifactory, Kestra OSS, Starlette and BerriAI LiteLLM. Two vulnerabilities received the maximum CVSS score of 10.0, and the overall attack picture shows a systemic shift: AI infrastructure components — gateways, orchestrators, model proxies — are becoming priority targets for credential theft, cryptominer deployment and persistence within victim environments. Organizations using any of the listed products need to apply available patches immediately.
Confirmed exploited vulnerabilities: SonicWall SMA 1000
The strongest evidence currently available concerns two vulnerabilities in SonicWall SMA 1000 appliances. According to the vendor’s official advisory, the company has confirmed active exploitation of both issues:
- CVE-2026-83548 (CVSS 10.0) — a server-side request forgery (SSRF) vulnerability that allows a remote, unauthenticated attacker to access critical functionality and perform unauthorized operations.
- CVE-2026-83549 (CVSS 7.8) — an authenticated operating system command injection vulnerability that enables an administrator to execute arbitrary OS commands, leading to remote code execution.
Firmware versions 12.4.3-03453 and 12.5.0-02835 are affected. Fixes are available in versions 12.4.3-03526 and 12.5.0-02952 respectively. Given the confirmed exploitation and the maximum CVSS score of the first vulnerability, updating SMA 1000 firmware should be the top priority.
AI infrastructure under attack: Kestra, LiteLLM, Starlette
Three out of the seven vulnerabilities affect components widely used in AI infrastructure, and this is where the most concerning trend emerges.
Kestra OSS: from workflow to cryptominer
CVE-2026-49869 (CVSS 10.0) is an OS command injection vulnerability in Kestra OSS that allows an unauthenticated attacker to create and execute arbitrary workflows without credentials. Versions prior to 1.0.45 and versions 1.1.0 through 1.3.20 are affected; fixes are available in versions 1.0.45 and 1.3.21.
According to a Microsoft report, in late June 2026 attackers used this vulnerability to implement a full attack chain with four impact vectors:
- Executing shell commands via the workflow engine
- Discovering the container environment by accessing the Docker socket
- Hijacking host resources by deploying a cryptominer
- Collecting data by running workflow tasks using the built-in Kestra key-value interface
Notably, the attackers used a curl-pipe-shell construct to encode the collected data and store it via Kestra’s own API, minimizing the creation of file artifacts on disk — a technique that makes detection by file monitoring tools more difficult.
LiteLLM: vulnerability chain for authentication bypass
CVE-2026-59822 (CVSS 8.8) is an improper authentication vulnerability in BerriAI LiteLLM on the Model Context Protocol (MCP) Streamable HTTP endpoint, allowing an attacker to establish an authenticated MCP session using an arbitrary Bearer token. Versions prior to 1.84.0 are affected.
This vulnerability is particularly interesting in the context of an exploitation chain. Earlier, in June 2026, a related vulnerability, CVE-2026-42271 (CVSS 8.8 under NVD v3.1), was disclosed, allowing authenticated users to execute arbitrary commands via test MCP stdio endpoints. This vulnerability was added to the KEV catalog on June 8, 2026.
Microsoft documented specific attacker actions during LiteLLM gateway compromises: deploying an XMRig miner via an ELF binary, pre-attack host profiling, terminating competing mining processes, accessing PostgreSQL tables (LiteLLM_ProxyModelTable and LiteLLM_VerificationToken) to extract provider keys, model configurations and proxy virtual keys. For persistence, they modified ~/.ssh/authorized_keys.
According to Wiz honeypot telemetry, attempts to exploit CVE-2026-59822 have been observed using single-character Bearer tokens to probe model enumeration endpoints such as /v1/models.
Starlette: weakening the authentication boundary
CVE-2026-48710 (CVSS 6.5) is an HTTP request smuggling vulnerability in Starlette versions up to and including 1.0.0. Malformed Host headers allow paths to be injected into the host portion of the URL, leading to authentication bypass in systems that rely on the reconstructed URL path. The issue is fixed in version 1.0.1. Microsoft describes this vulnerability as a potential factor in weakening the authentication boundary in LiteLLM attack chains, although it does not confirm that every observed intrusion used both CVEs.
Additional vulnerabilities in the catalog
CVE-2026-9586 (CVSS 9.3) is an SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (build 104997), allowing an unauthenticated attacker to execute arbitrary SQL queries against the PostgreSQL server, including remote code execution.
CVE-2026-82329 (CVSS 9.8) is an improper authentication vulnerability in JFrog Artifactory, which under default configuration allows an attacker to obtain administrative privileges without authentication.
According to researchers, both vulnerabilities have been used to deploy reverse shells and create administrative tokens for subsequent enumeration of users, groups and federated access topologies. However, the primary reports from Horizon3.ai and watchTowr, cited in the original source, have not been independently verified.
Indicators of Compromise
Microsoft and Wiz have published the following IOCs related to attacks on AI infrastructure:
- IP addresses: 45.150.109.151, 135.125.10.56:19888, 172.232.38.92:32991, 47.86.197.116, 194.213.18.133
- Domains: 45.150.109.151.sslip[.]io, auto.c3pool[.]org, gobygo[.]net, oast[.]me, oast[.]pro, oast[.]fun
- Hashes: f64b88e9318bdf23f2dd119a0ce1dd1bdb3c8cd2e0e1e23ba3ef2e19072b79cc, 49fdcf32bfe837899a84e8938f0d07ae96ddd218a280a09eb60df8d64597bd8f
- Targeted endpoints: /v1/models, /mcp/, /mcp-rest/test/connection
Practical recommendations
- SonicWall SMA 1000: immediately update firmware to versions 12.4.3-03526 or 12.5.0-02952. Check logs for signs of unauthorized access via SSRF.
- Kestra OSS: update to versions 1.0.45 or 1.3.21. Audit created workflows for unauthorized entries. Restrict access to the Docker socket from Kestra containers.
- LiteLLM: update to version 1.84.0 (for CVE-2026-59822) and 1.83.7 (for CVE-2026-42271). Check the LiteLLM_ProxyModelTable and LiteLLM_VerificationToken tables for unauthorized access. Rotate all provider API keys.
- Starlette: update to version 1.0.1.
- General measures: monitor AI workloads as components of the control plane rather than as isolated applications. Check
~/.ssh/authorized_keysfiles for unauthorized changes. Add the listed IOCs to detection rules.
This KEV catalog update marks a qualitative shift in the attack landscape: AI infrastructure components — model proxies, workflow orchestrators, MCP servers — are being exploited using the same playbooks as traditional web applications, but with the added bonus for attackers of gaining access to major LLM providers’ API keys. Patch priority: SonicWall SMA 1000 and Kestra OSS (CVSS 10.0, confirmed exploitation), followed by LiteLLM and JFrog Artifactory, and then Starlette. For organizations unable to update immediately, it is critical to isolate affected services from external access and limit network communication to the bare minimum required.
