CISA Adds Seven Critical Vulnerabilities to its KEV

TL;DR

Federal officials warned organizations about seven newly abused security flaws. The agency confirmed that threat actors actively exploit these CISA KEV vulnerabilities across enterprise networks. Consequently, system administrators must apply vendor patches immediately to stop intrusions.

Notable CVEs

Why It Matters

Threat actors frequently target public-facing network appliances and developer tools. According to federal warnings, “These types of vulnerabilities are a frequent attack vector for malicious cyber actors.” Compromising these systems allows attackers to steal corporate data and deploy ransomware. Furthermore, two of the reported flaws carry a maximum CVSS score of 10.0. Industry estimates indicate that thousands of organizations deploy these impacted systems worldwide. Active exploitation is already occurring in the wild. Therefore, security teams must prioritize these remediations.

How the Attack Works

Adversaries exploit different weaknesses across the affected products. In Kestra OSS (CVE-2026-49869), the platform uses a loose suffix check on API paths. Attackers append this string to bypass authentication and execute code as root. Meanwhile, SonicWall SMA1000 appliances suffer from an alternate access path flaw (CVE-2026-83548). Attackers use this issue to reach sensitive features without prior authentication. Additionally, Sangoma Switchvox (CVE-2026-9586) concatenates phone parameters directly into SQL queries without sanitization. An attacker sends a single request to execute database commands. Finally, Starlette and LiteLLM permit request smuggling and authentication bypasses.

Affected Versions

These flaws affect Sangoma Switchvox SMB Edition 8.3 and Starlette releases prior to 1.0.1. Kestra OSS versions before 1.0.45 and LiteLLM versions before 1.84.0 are also vulnerable. Additionally, JFrog Artifactory and SonicWall SMA1000 appliances harbor active flaws. CISA confirmed that threat actors currently exploit all seven weaknesses in live attacks.

Patch or Mitigation Steps

Administrators must deploy official security updates immediately to secure their environments. Upgrade Starlette to version 1.0.1 and Kestra to 1.0.45 or 1.3.21. Update LiteLLM to 1.84.0 and patch SonicWall appliances promptly. Isolating administrative interfaces behind private firewalls also mitigates exposure. Applying vendor patches resolves these dangerous CISA KEV vulnerabilities.

Support Our Threat Intelligence

Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.