The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added seven security vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog following evidence of active, in-the-wild exploitation. The newly cataloged flaws span enterprise remote access gateways, SQL database engines, container automation pipelines, and emerging artificial intelligence model orchestration frameworks.

The additions trigger binding operational directives for federal civilian executive branch (FCEB) agencies under Binding Operational Directive (BOD) 26-04, requiring rapid mitigation within strictly enforced deadlines. The wide functional range of the targeted software highlights how threat groups are concurrently seeking initial access through legacy edge appliances while systematically probing modern AI deployment infrastructure.

Network Gateways and Enterprise Software Under Attack

Among the most critical vulnerabilities added to the catalog are two security bugs affecting SonicWall Secure Mobile Access (SMA) 1000 Series enterprise gateways:

• CVE-2026-83548 (CVSS 10.0): A maximum-severity Server-Side Request Forgery (SSRF) flaw in the Work Place interface of SonicWall SMA1000 appliances. This unauthenticated vulnerability allows remote attackers to bypass authentication boundaries and execute administrative commands on internal resources.

• CVE-2026-83549 (CVSS 7.8): A post-authentication operating system command injection vulnerability in the SonicWall Appliance Management Console (AMC). When leveraged by an attacker with administrative access (or chained with an authentication bypass like CVE-2026-83548), it enables remote code execution with elevated root-level privileges.

Beyond perimeter appliances, threat actors have intensified automated scanning and attack campaigns against widely deployed enterprise management platforms:

• Sangoma Switchvox (CVE-2026-9586, CVSS 9.3): A severe SQL injection vulnerability in Sangoma’s business phone system software. Remote, unauthenticated attackers can issue a single malicious request to execute arbitrary SQL commands against the backend PostgreSQL database, leading to file system modification and system takeover.

• JFrog Artifactory (CVE-2026-82329, CVSS 9.8): An improper authentication flaw under default installations that allows unauthenticated network attackers to mint administrative tokens and gain elevated access over software artifact repositories.

Targeting Emerging Artificial Intelligence and Automation Pipelines

A notable trend highlighted in CISA’s alert is the rapid pivot of cybercriminal groups toward developer tools and AI infrastructure. As enterprises integrate Model Context Protocol (MCP) servers and orchestration layers into production, these environments have become prime targets for secret exfiltration and persistent access:

• BerriAI LiteLLM (CVE-2026-59822, CVSS 8.8): An improper authentication flaw in LiteLLM’s Model Context Protocol (MCP) Streamable HTTP endpoint. Attackers can establish authenticated MCP sessions using arbitrary Bearer tokens, granting access to downstream Large Language Model (LLM) provider keys, internal prompt flows, and system parameters.

• Kestra OSS (CVE-2026-49869, CVSS 10.0): An OS command injection bug in Kestra’s open-source orchestration server. Unauthenticated remote attackers can create and run custom workflows to deploy persistent reverse shells, conduct internal network reconnaissance, and drop cryptocurrency miners.

Threat intelligence analysis from security firms including Microsoft and Wiz confirmed that threat actors—including ransomware operators such as the Qilin group—are actively scanning public IP ranges for exposed LiteLLM, LangChain, Flowise, and ChromaDB instances to exfiltrate API keys and execute indirect prompt injections.

Compliance Mandates and Enterprise Defense Strategies

Under the terms of BOD 26-04, federal civilian agencies must apply patches for the majority of these flaws by September 5, 2026, with full remediation for the remaining AI-related protocols mandated by September 16, 2026. Private sector organizations are strongly urged to align with these timelines.

To secure systems against this active threat campaign, organizations should execute the following defensive actions:

• Isolate Edge Appliances: Immediately update SonicWall SMA1000 appliances to approved firmware builds (12.4.3-03453 or 12.5.0-02835) and verify that management interfaces are not directly exposed to the public internet.

• Audit AI Orchestration Nodes: Conduct discovery scans to identify all running instances of LiteLLM, LangChain, and MCP servers. Enforce strict API authentication, restrict outbound traffic, and rotate exposed API tokens.

• Implement Database Query Sanitization: Update Sangoma Switchvox servers and audit PostgreSQL database logs for unexpected administrative queries or reverse shell connections.

As adversaries increasingly automate the discovery and weaponization of vulnerabilities across diverse software stacks, rapid patching and strict network perimeter hygiene remain essential components of an effective cyber defense posture.