4 SEP 2026 — The Known Exploited Vulnerabilities catalogue is the United States federal list of flaws agencies must remediate on a clock. CISA added seven to it on 2 September. Five carry a deadline of 5 September and two carry 16 September. That split, three days for one group and fourteen for the other, comes from an agency whose three-day clock has been reported as the new default.
What was added
The list runs across remote access, telephony, artifact hosting and workflow tooling. CVE-2026-83548 in SonicWall SMA1000, a pre-authentication server-side request forgery rated CVSS 10.0, and CVE-2026-83549 in the same appliance, a post-authentication command injection rated 7.8. CVE-2026-9586 in Sangoma Switchvox at 9.3, a SQL injection against the backend PostgreSQL database. CVE-2026-82329 in JFrog Artifactory at 9.8, improper authentication under the default configuration.
The other three carry a longer clock or a newer profile. CVE-2026-49869 in Kestra OSS at 10.0, unauthenticated command injection through workflow creation, which Microsoft reported being exploited from late June to deploy reverse shells and cryptocurrency miners. CVE-2026-48710 in Starlette at 6.5, request smuggling enabling authentication bypass, chainable with CVE-2026-42271 and linked to the Qilin ransomware group. And CVE-2026-59822 in Berri LiteLLM at 8.8, improper authentication in a Model Context Protocol endpoint.
The three-day clock is not the whole rule
We reported in August that CISA's remediation deadline had collapsed from three weeks to three days and had become the default. This batch qualifies that story.
Five entries got three days. Starlette and LiteLLM got fourteen. Those two are open-source libraries that ship inside other people's applications rather than appliances an administrator can patch on a schedule, and they score lower on CVSS than any of the five.
The listing does not say whether the agency is splitting by severity, by patchability, or by both. The catalogue publishes the two dates without reasoning, so the only way to learn the rule is to watch the batches, and this is the first to make the variation visible.
Patching a library is a different job
The distinction matters operationally whatever CISA's reasoning was. An SMA1000 is an appliance with a vendor hotfix, an inventory an organisation can enumerate, and a maintenance window.
Starlette is a Python framework that arrives inside other software. Finding every application that depends on it, directly or through something else that depends on it, is a software bill of materials problem, and the organisations that can answer it in three days are the ones that already maintain one. Fourteen days is roughly the time it takes to run that search and get changes through review.
LiteLLM is the same shape. It is a proxy that sits between applications and model providers, so it is deployed by whoever stood up the AI gateway, which in many organisations is not the team that would receive a KEV notice.
Three of the seven are AI and build infrastructure
Two years ago nobody would have grouped LiteLLM, Kestra and JFrog Artifactory together. Now they land in the same bucket, as a model gateway, a workflow orchestrator and an artifact repository, all sitting in the path between a developer and production.
The LiteLLM listing is the newest of this group. The flaw is improper authentication in a Model Context Protocol endpoint, so the exposed surface is the interface a model uses to reach tools. That is a control-plane component for AI agents appearing in a federal exploited-vulnerability catalogue.
We wrote in August about a LiteLLM token that reached three tools deep. The pattern holds. The damage from a compromised gateway is not in the gateway itself but in everything it is trusted to call.
The evidence behind the listings is not uniform
Known Exploited implies one standard, but the underlying evidence here varies considerably.
SonicWall confirmed active exploitation of its own appliances. Microsoft reported Kestra exploitation with a described attack chain from late June. Horizon3.ai and watchTowr documented Switchvox weaponisation deploying reverse shells, and watchTowr reported admin tokens minted through the Artifactory flaw. These are reports of active intrusions.
The LiteLLM listing rests on Wiz observing honeypot probing of model enumeration endpoints. A honeypot is a decoy, so what was observed is somebody scanning for the flaw rather than a confirmed compromise of a production system. That is a legitimate signal and a weaker one, and the catalogue records both under the same heading.
What a defender should take from the batch
The SonicWall listing closes a gap we flagged the day before. When we reported the second SMA1000 chain in ten weeks, neither identifier was in KEV, and we argued that waiting for a listing means waiting on a signal built for somebody else's compliance obligation. Both were added the following day, which is fast by the catalogue's standards and still after the exploitation.
The practical sequence is unchanged. Patch on the vendor advisory, not the listing. Then work out what you can actually enumerate. Appliances are an asset list; libraries are a dependency graph, and only the asset list can be compiled in an afternoon.
For the two AI-adjacent entries, ask who owns them. A model gateway or workflow engine is often deployed by a platform or data team, outside the security team's inventory. A KEV notice sent to security may never reach the person who can patch the proxy.
View author profile → · Editorial policy
