CISA Just Flagged 7 Actively Exploited Bugs — Here's What's Actually Happening
CISA's Known Exploited Vulnerabilities (KEV) catalog exists for one reason: to separate the vulnerabilities that are theoretically dangerous from the ones actively being used in real attacks right now. Its latest batch of seven additions spans networking appliances, dev infrastructure, and workflow automation tools — and the attack pattern behind them is consistent enough to be worth understanding, not just patching around.
The seven, and why they're not equally scary
Two stand out for maximum severity. CVE-2026-83548, a server-side request forgery flaw in SonicWall's SMA 1000 series, and CVE-2026-49869, an OS command injection bug in Kestra OSS that allows unauthenticated remote workflow execution, both carry a CVSS score of 10.0 — the ceiling. A perfect score means there's essentially no precondition standing between an attacker and full compromise.
The rest of the list is still serious: a SQL injection flaw in Sangoma's Switchvox VoIP platform (9.3), an authentication bypass in JFrog Artifactory granting admin privileges (9.8), HTTP request smuggling in the Starlette Python framework enabling auth bypass (6.5), and an authentication bypass in Berri's LiteLLM proxy via forged Bearer tokens (8.8). That LiteLLM flaw is worth pausing on — LiteLLM sits in front of LLM API calls for a lot of AI infrastructure, meaning a bypass there doesn't just expose a web app, it can expose whatever model access and API keys sit behind it.
The actual attack chain
What makes this batch worth writing about isn't the individual CVEs — it's that CISA is describing a consistent playbook across them: attackers get in through one of these flaws, drop a reverse shell to get a persistent command channel, then modify SSH authorized-keys files to guarantee they can get back in even if the original vulnerability gets patched. From there, the most common payload isn't data theft — it's deploying XMRig to mine cryptocurrency using the compromised system's own compute.
That's a telling detail. Crypto-mining payloads are often dismissed as the "low stakes" outcome of a breach compared to ransomware or data exfiltration, but the presence of SSH key persistence means the mining is often just the visible symptom — the attacker has already secured long-term access that could be repurposed for something worse whenever it's convenient for them. CISA's advisory specifically notes credential and API key harvesting alongside the mining activity, which is the part that should actually worry defenders.
The deadline pressure is real, even if you're not a federal agency
Under Binding Operational Directive 26-04, federal agencies had until September 5, 2026 to patch most of these, with a short extension to September 16 for the Starlette and LiteLLM flaws. Those deadlines only bind federal agencies directly — but they're a useful signal for everyone else. CISA doesn't set aggressive remediation windows for vulnerabilities it considers speculative; KEV entries are, by definition, already being exploited in the wild. A private-sector deadline of "whenever we get to it" on the same flaws is a bet against attackers who are demonstrably already active.
What to actually do about it
If you're running SonicWall SMA 1000, Sangoma Switchvox, JFrog Artifactory, Kestra OSS, Starlette, or LiteLLM in any part of your stack, patching is the obvious first step — but given the SSH-key-persistence pattern here, patching alone doesn't undo an intrusion that already happened. Anyone running these products should also be auditing `authorized_keys` files for unexpected entries and reviewing outbound network activity for signs of mining traffic or unfamiliar API usage, especially around AI infrastructure components where LiteLLM or similar proxies are involved.
The broader lesson tracks with most KEV updates: the vulnerability existing isn't the news. Attackers already using it, with a repeatable playbook for persistence, is.