On September 2, 2026, CISA added seven vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. While the list spans network appliances, CI/CD platforms, and telephony systems, the most operationally significant additions target AI inference infrastructure: a Model Context Protocol (MCP) authentication bypass in BerriAI's LiteLLM and an unauthenticated workflow injection in Kestra OSS.

Concurrent reporting from Microsoft and Wiz documents multi-stage attack campaigns exploiting these AI gateways to steal LLM provider API keys, deploy XMRig cryptocurrency miners, and establish persistent reverse shell access — with links to the Qilin (Agenda) ransomware group.

Confirmed

  • CVE-2026-83548 (CVSS 10.0): Unauthenticated SSRF in SonicWall SMA 1000 appliances granting access to sensitive internal functionality. SonicWall confirmed active exploitation.
  • CVE-2026-83549 (CVSS 7.8): Post-authentication OS command injection in SonicWall SMA 1000 enabling remote code execution as administrator. SonicWall confirmed active exploitation.
  • CVE-2026-9586 (CVSS 9.3): SQL injection in Sangoma Switchvox allowing unauthenticated arbitrary SQL execution against the backend PostgreSQL database, including remote code execution via a single crafted request. Horizon3.ai and watchTowr observed reverse shell deployment.
  • CVE-2026-82329 (CVSS 9.8): Improper authentication in JFrog Artifactory — default configuration allows unauthenticated attackers to obtain administrative privileges. Horizon3.ai and watchTowr reported minted admin tokens used for enumeration of users, groups, credential sets, and federated access topologies.
  • CVE-2026-48710 (CVSS 6.5): HTTP request/response smuggling in Kludex Starlette enabling path injection and authentication bypass. Horizon3.ai demonstrated chaining with CVE-2026-42271 (LiteLLM, CVSS 8.7) for full remote code execution.
  • CVE-2026-49869 (CVSS 10.0): Unauthenticated OS command injection in Kestra OSS workflow engine. Microsoft documented a late-June 2026 campaign establishing reverse shells, Docker container discovery, defense evasion, XMRig miner deployment, and data harvesting via Kestra's own key-value interface.
  • CVE-2026-59822 (CVSS 8.8): Improper authentication in BerriAI LiteLLM's MCP Streamable HTTP endpoint allowing unauthenticated session establishment with arbitrary Bearer tokens. Wiz observed active probing against honeypots targeting model enumeration endpoints.

AI infrastructure as attack surface

Microsoft and Wiz jointly assessed that AI infrastructure components — including LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, Marimo, and MCP servers — have become lucrative targets for threat actors seeking to:

  • Steal upstream provider API keys and proxy-issued virtual keys from LiteLLM's PostgreSQL data tier (LiteLLM_ProxyModelTable, LiteLLM_VerificationToken tables).
  • Access backend systems and maintain persistence via ~/.ssh/authorized_keys modification.
  • Monetize compromised hosts through XMRig cryptocurrency mining (delivered as ELF binaries after terminating competing miner processes).
  • Conduct blind prompt injections and AI-native post-exploitation against exposed inference pipelines.

In a separate campaign, Microsoft suspects adversaries are exploiting exposed RAGFlow instances to steal LLM provider keys and metadata.

Unknown

  • Qilin ransomware scope: Wiz linked the LiteLLM exploit chain to Qilin (Agenda) ransomware operators, but the full extent of ransomware deployment via AI gateway compromise is not quantified in public reporting.
  • Patch compliance timeline: BOD 26-04 requires FCEB agencies to patch most of these flaws by September 5, 2026, with CVE-2026-48710 and CVE-2026-59822 extended to September 16. Private-sector adoption timelines remain voluntary.
  • MCP ecosystem blast radius: LiteLLM's MCP Streamable HTTP endpoint flaw (CVE-2026-59822) affects any deployment exposing the MCP interface without additional authentication layers. The number of internet-exposed LiteLLM instances is not disclosed.

Why it matters

This KEV batch signals a shift in threat actor targeting. AI model gateways, workflow engines, and inference proxies are no longer theoretical attack surfaces — they are actively exploited production targets where a single authentication bypass yields API keys worth thousands of dollars in compute credits, persistent backdoors into cloud accounts, and lateral movement paths into upstream model providers.

Our take

The LiteLLM and Kestra entries are the headline. When a Qilin-linked ransomware crew chains an MCP authentication bypass with an LLM proxy SQL dump to harvest provider keys and deploy miners, AI infrastructure has crossed from "monitor your logs" territory into "patch or lose your API budget." Microsoft's advice to treat AI workloads by their control-plane role rather than as isolated applications is the correct operational framing — and the September 5 BOD deadline for federal agencies underscores the urgency.

Sources