CISA KEV Catalog Update: Seven Actively Exploited Vulnerabilities (Sept 2026)

Technical Analysis

The catalog addition includes CVE-2026-9586 (Sangoma Switchvox SQLi), CVE-2026-48710 (Starlette HTTP request/response smuggling), CVE-2026-49869 (Kestra OSS OS command injection), CVE-2026-59822 (BerriAI LiteLLM improper authentication), CVE-2026-82329 (JFrog Artifactory improper authentication), and CVE-2026-83548/83549 (SonicWall SMA1000 SSRF and OS command injection). Several of these components are directly used in AI agent and LLM infrastructure: Starlette underpins many Python async web frameworks (including FastAPI) commonly used to serve agent APIs and RAG backends, and its smuggling flaw could allow request desync attacks against agent-facing endpoints; LiteLLM is a widely deployed unified LLM gateway/proxy used by organizations to route calls across multiple model providers, and an authentication bypass here could allow unauthorized access to API keys, model routing configs, and potentially prompt/response data flowing through agent pipelines. Kestra's OS command injection is notable for workflow/orchestration platforms that may trigger agent tasks or data pipelines, and JFrog Artifactory is frequently used to store and distribute packages/models that agent build pipelines pull from, creating a supply-chain risk vector. Successful exploitation of the LiteLLM or Artifactory flaws in particular could grant attackers control over credentials or artifacts that agent systems depend on for authentication and model access.

Affected Systems

Sangoma Switchvox (SQL injection vulnerable versions); Kludex Starlette (HTTP request/response smuggling affected versions, impacts FastAPI/ASGI-based deployments); Kestra OSS (OS command injection vulnerable versions); BerriAI LiteLLM (improper authentication vulnerable versions, LLM proxy/gateway deployments); JFrog Artifactory (improper authentication affected versions); SonicWall SMA1000 Appliances (SSRF and OS command injection vulnerable firmware versions)

Indicators of Compromise

• No specific IOCs (hashes/IPs/domains) published in this CISA alert; organizations should consult vendor advisories and CISA KEV catalog entries for detection guidance

Remediation Steps

1. 1

   Apply vendor patches immediately

   Update Sangoma Switchvox, Starlette, Kestra OSS, LiteLLM, JFrog Artifactory, and SonicWall SMA1000 to patched versions per vendor advisories referenced in the CVE records.

2. 2

   Audit LiteLLM and Artifactory deployments

   Organizations running LiteLLM as an LLM gateway or Artifactory as a package/model repository should review access logs for unauthorized authentication and rotate any API keys or credentials that may have been exposed.

3. 3

   Compromise assessment for FCEB and high-risk assets

   Per BOD 26-04, check whether systems were compromised prior to patching, especially internet-exposed assets running affected software.

4. 4

   Restrict internet exposure

   Limit public exposure of SonicWall SMA1000 appliances, Switchvox, and internal orchestration tools like Kestra; apply network segmentation and WAF rules where patching cannot occur immediately.

5. 5

   Review agent/RAG pipeline dependencies

   Inventory whether AI agent frameworks or RAG pipelines rely on Starlette/FastAPI, LiteLLM, or Artifactory, and prioritize remediation given the potential for credential exposure or request smuggling against agent-facing APIs.