What was added
CISA added seven vulnerabilities to its Known Exploited Vulnerabilities catalogue on 2 September. Inclusion in that catalogue is not a severity rating — it means the agency has evidence the flaw is being exploited in the wild.
The seven are CVE-2026-9586 in Sangoma Switchvox, CVE-2026-48710 in Kludex Starlette, CVE-2026-49869 in Kestra OSS, CVE-2026-59822 in BerriAI LiteLLM, CVE-2026-82329 in JFrog Artifactory, and CVE-2026-83548 and CVE-2026-83549 in SonicWall SMA1000 appliances.
Three of them — LiteLLM, Kestra and JFrog Artifactory — sit in the stack that AI applications are built on. That is the part worth noticing.
The LiteLLM flaw, specifically
LiteLLM is a proxy that gives applications one API in front of many model providers. CVE-2026-59822 is an authentication bypass in its Model Context Protocol streamable HTTP endpoint, scored 8.8.
The mechanism is a fallback path. In versions before 1.84.0, a request carrying a fabricated Authorization header would fail LiteLLM key validation and then fall through to an OAuth2 passthrough branch, which substituted an empty UserAPIKeyAuth() object for the failed check. The request continued as authenticated. An unauthenticated caller could therefore open an MCP session and reach whatever tools the deployment had configured behind it.
MCP is what makes this more than a proxy bug. The protocol exists so a model can call tools, and a gateway sitting in front of MCP tooling typically has the credentials for the systems those tools touch. The fix is version 1.84.0.
Who actually has a deadline
Under Binding Operational Directive 26-04, federal civilian agencies must remediate KEV entries on a schedule; the directive prioritises publicly exposed assets where exploitation hands over full control. eSecurity Planet reported the deadline for most of this batch as 5 September, with LiteLLM and Starlette extended to 16 September.
Everyone else is unaffected by that clock. Private-sector operators running LiteLLM in front of production model traffic have the same bug and no compliance date, which is the usual asymmetry of the KEV process: it makes an exploited flaw public and only obliges one class of operator to act.
The pattern behind the batch
eSecurity Planet reported that Microsoft and Wiz have documented active campaigns against AI infrastructure over a 90-day window, involving credential harvesting, persistence, reverse shells and cryptomining. None of that is novel attacker tradecraft. What is new is where it is being pointed: at the gateways, orchestrators and artifact registries that sit between an application and a model, rather than at the models themselves.
If you run LiteLLM, the action is to check the version. If you run anything MCP-facing, the more useful question is what credentials sit behind the tools it exposes.
