CISA's addition of seven vulnerabilities to its Known Exploited Vulnerabilities Catalog on September 2, 2026 is significant because the list includes flaws affecting VoIP systems, web frameworks, workflow orchestration platforms, AI infrastructure, software repositories and remote-access appliances. 

What connects these vulnerabilities is more important than the diversity of products involved.

Several of them can ultimately provide attackers with administrative privileges, arbitrary command execution or access to highly sensitive infrastructure. These are not theoretical weaknesses waiting for somebody to write a proof-of-concept. Inclusion in CISA's KEV Catalog means there is evidence that attackers are already exploiting them.

Organizations should therefore treat these vulnerabilities as incident-response priorities rather than ordinary entries in a monthly patch cycle.

CVE-2026-9586 – Sangoma Switchvox SQL Injection 

CVE-2026-9586 affects Sangoma Switchvox SMB Edition and is particularly serious because exploitation can occur without authentication.

The vulnerability exists in the `/pa` endpoint, where attacker-controlled data contained in a `PhoneIP` value can be incorporated into PostgreSQL queries without adequate sanitization or parameterization.

Researchers have reported that exploitation can ultimately allow an unauthenticated attacker to execute arbitrary code with PostgreSQL superuser privileges. The vulnerability carries a CVSS score of 9.3 and affects Switchvox SMB Edition 8.3 build 104997. Sangoma addressed the issue in Switchvox 8.4.0.2.

This vulnerability demonstrates why SQL injection should no longer automatically be regarded simply as a database confidentiality problem.

Depending on database privileges and available functionality, SQL injection can become a pathway to operating-system command execution.

For an internet-facing VoIP appliance, that changes the risk considerably. Once attackers obtain execution on the appliance, the compromise could potentially be used for persistence, credential theft, internal reconnaissance or movement further into the enterprise.

Organizations operating Switchvox should not limit their response to patching. Systems exposed to the internet while vulnerable should also be reviewed for indicators of prior exploitation.

CVE-2026-48710 – Starlette HTTP Request/Response Smuggling 

CVE-2026-48710 affects Starlette, the Python ASGI framework that also forms part of the ecosystem behind many modern Python web applications.

The problem originates from insufficient validation of the HTTP `Host` header when Starlette reconstructs `request.url`.

A malformed `Host` value can cause the path represented by `request.url.path` to differ from the path actually being processed by the application's router. If application middleware makes security decisions based on `request.url.path`, an attacker may be able to bypass those controls.

Affected versions are Starlette 1.0.0 and earlier, with version 1.0.1 containing the fix.

The important lesson is that security controls implemented at different layers must agree about what request is actually being processed.

If a reverse proxy, web framework and security middleware interpret an HTTP request differently, attackers can exploit the disagreement.

This is the fundamental danger behind request-smuggling and parser-differential vulnerabilities.

Organizations using Starlette directly should review their versions, but the dependency issue is equally important. Development teams should determine whether Starlette is being pulled into applications indirectly through another Python package or framework.

CVE-2026-49869 – Kestra OSS OS Command Injection 

CVE-2026-49869 is particularly dangerous because it can result in unauthenticated remote code execution in Kestra OSS.

The vulnerability involves an authentication bypass caused by Kestra's `AuthenticationFilter`. A public configuration endpoint was identified using an `endsWith("/configs")` check rather than matching an exact path.

As a result, an attacker can craft other API paths ending in `/configs` and bypass authentication.

Once authentication is bypassed, an attacker may be able to create and execute workflows. Because Kestra includes shell and scripting capabilities, that can translate directly into arbitrary command execution on the underlying worker environment.

Affected versions include Kestra 1.3.20 and earlier, with fixes available in 1.3.21 and 1.0.45.

This vulnerability deserves special attention from organizations using workflow and orchestration platforms.

Such platforms frequently possess credentials for databases, cloud environments, CI/CD systems, storage services and Kubernetes clusters. Compromise of the orchestration platform can therefore provide attackers with access far beyond the host running the application.

Security teams should treat workflow engines as privileged infrastructure rather than ordinary web applications.

CVE-2026-59822 – BerriAI LiteLLM Authentication Bypass 

CVE-2026-59822 affects LiteLLM and demonstrates that AI infrastructure is rapidly becoming part of the conventional enterprise attack surface.

The vulnerability affects LiteLLM's MCP Streamable HTTP endpoint.

During OAuth2 passthrough processing, failed LiteLLM key validation could fall back to an empty authentication object. An attacker supplying an arbitrary Bearer token could therefore establish what appeared to be an authenticated MCP session without possessing a valid LiteLLM key.

This could allow an attacker to enumerate and invoke configured MCP tools and potentially access services connected through those tools.

Versions earlier than LiteLLM 1.84.0 are affected, and the issue is fixed in version 1.84.0.

The security implications extend well beyond the AI model itself.

MCP servers are increasingly being used to connect AI systems with databases, internal APIs, source-code repositories, file systems and other enterprise services.

An authentication bypass at this layer could therefore allow an attacker to invoke capabilities that the organization intentionally made available to its AI agents.

As enterprises deploy more AI gateways and agentic infrastructure, these systems need to be incorporated into the same vulnerability management, network segmentation and access-control processes applied to traditional application infrastructure.

CVE-2026-82329 – JFrog Artifactory Authentication Bypass 

CVE-2026-82329 affects JFrog Artifactory and is one of the most concerning vulnerabilities in the group because successful exploitation may provide administrative access.

JFrog describes the vulnerability as an authentication weakness that, under the default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

JFrog rates the vulnerability Critical and has released patched versions across multiple Artifactory release branches. For example, fixes include 7.161.20, 7.146.38, 7.133.29, 7.125.20 and corresponding patched releases in supported branches.

An Artifactory compromise should be considered potentially more serious than compromise of an isolated server.

Artifact repositories occupy a highly trusted position within software-development environments. They may contain application packages, container images and other components subsequently consumed by CI/CD systems and production deployments.

Administrative control of such infrastructure raises the possibility of software-supply-chain compromise.

An attacker does not necessarily need to attack every downstream server directly. Modifying something that trusted build or deployment systems subsequently consume can provide a much more scalable attack path.

Organizations that operated vulnerable internet-accessible Artifactory instances should therefore consider reviewing administrative activity, token creation, repository modification and recently uploaded or altered artifacts in addition to applying the update.

CVE-2026-83548 – SonicWall SMA1000 SSRF 

CVE-2026-83548 affects SonicWall SMA1000 appliances and has been assigned the maximum CVSS score of 10.0.

The vulnerability is a pre-authentication server-side request forgery flaw involving unintended forward-proxy behaviour. SonicWall has confirmed that the vulnerability is actively being exploited.

A remote unauthenticated attacker may be able to cause the SMA appliance to send requests to unintended destinations.

SSRF vulnerabilities are particularly dangerous on perimeter appliances because the compromised device often occupies a privileged network position.

Requests originating from the appliance may be capable of reaching backend or internal services that would not normally be accessible directly from the internet.

This means SSRF should not simply be interpreted as "the server can fetch a URL."

Depending on network architecture, it may become a mechanism for internal reconnaissance, authentication bypass, access to management interfaces or interaction with services protected by network-level trust.

CVE-2026-83549 – SonicWall SMA1000 OS Command Injection 

CVE-2026-83549 affects the same SonicWall SMA1000 family but has a different exploitation characteristic.

It is a post-authentication command-injection vulnerability that can lead to remote code execution. SonicWall rates it High with a CVSS score of 7.8 and has confirmed active exploitation.

The combination of CVE-2026-83548 and CVE-2026-83549 deserves particular attention.

Even where two vulnerabilities cannot necessarily be assumed to form a specific exploit chain without further evidence, defenders should always investigate whether vulnerabilities affecting the same appliance could provide complementary attacker capabilities.

One vulnerability may enable access to otherwise unreachable functionality, while another provides command execution after the attacker reaches the required security context.

That possibility is exactly why vulnerability management should not evaluate individual CVEs solely by CVSS score.

SonicWall has released fixed SMA1000 firmware builds 12.4.3-03526 and 12.5.0-02952. The vendor is also advising affected customers to review appliances for indicators of compromise. If compromise is detected, SonicWall recommends re-imaging or redeploying the appliance, changing user and administrator passwords and resetting TOTP tokens.

That remediation guidance is important.

Once an attacker has achieved command execution on a security appliance, simply installing a patch cannot establish that the appliance is trustworthy again.

The Most Important Message from the Seven CVEs 

These seven vulnerabilities affect very different technologies, but several recurring security problems appear across them.

Authentication boundaries are being bypassed.

Input is reaching interpreters that should never receive attacker-controlled commands.

Different HTTP processing layers are interpreting requests inconsistently.

Trusted infrastructure such as artifact repositories and orchestration platforms is being exposed to attacks that can potentially provide control over much larger environments.

And perimeter security appliances themselves continue to be valuable attack targets.

The inclusion of these vulnerabilities in CISA's KEV Catalog changes the response priority.

Organizations should first identify whether any affected systems are present, determine whether they were externally accessible during the vulnerable period and patch or upgrade them immediately.

But for actively exploited vulnerabilities, patching should be accompanied by compromise assessment.

Security teams should review authentication logs, newly created administrative accounts, access tokens, configuration changes, unexpected outbound connections, newly installed files and processes, repository modifications and other product-specific indicators.

The distinction is simple but important:

A vulnerability advisory tells you that attackers could exploit a weakness.

A KEV entry tells you that attackers already are.

At that point, vulnerability management and incident response begin to overlap.

CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-9586 Sangoma Switchvox SQL Injection Vulnerability CVE-2026-48710 Kludex Starlette HTTP Request/Response Smuggling Vulnerability CVE-2026-49869 Kestra OSS OS Command Injection Vulnerability CVE-2026-59822 BerriAI LiteLLM Improper Authentication Vulnerability CVE-2026-82329 JFrog Artifactory Improper Authentication Vulnerability CVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability CVE-2026-83549 SonicWall SMA1000 Appliances OS Command Injection Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the

Source: CISA Adds Seven Known Exploited Vulnerabilities to Catalog via CISA Advisories — published 02 Sep 2026.