This month: 8 KEVs detected

CISA stopped reliably sending KEV alerts.
We didn't.

CyberComply monitors the CISA Known Exploited Vulnerabilities catalog 24/7 and alerts you the moment a new KEV drops — before the deadline clock starts ticking without you knowing.

CVE-2026-49869
Kestra · Kestra OSS
Kestra OSS OS Command Injection Vulnerability
Detected Sep 2 · 3-day patch deadline
CVE-2026-82329
JFrog · Artifactory
JFrog Artifactory Improper Authentication Vulnerability
Detected Sep 2 · 3-day patch deadline
CVE-2026-83548
SonicWall · SMA1000 Appliances
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
Detected Sep 2 · 3-day patch deadline

KEV Intelligence Brief — September 4, 2026

Prepared by: Cybersecurity Intelligence | Distribution: Federal Contractors, DevOps, SecOps Leadership Brief Date: Friday, September 4, 2026 | Catalog Additions Covered: 8 CVEs added September 2–4, 2026

CISA's latest KEV additions paint a consistent and urgent picture: attackers are actively exploiting foundational infrastructure — network access appliances, artifact repositories, workflow automation platforms, and AI middleware — while continuing to weaponize browser-side execution vectors. Five of the eight entries carry patch deadlines of September 5, meaning federal agencies and BOD 26-04-scoped contractors are, as of this brief, operating with fewer than 24 hours of compliance runway on the most critical entries. Treat this cycle as a red-letter event.

Immediate Action Required: Perimeter and Infrastructure at Critical Risk

Four vulnerabilities share a September 5 patch deadline and collectively represent unauthenticated or near-unauthenticated pathways to full system compromise on internet-facing infrastructure. These are not theoretical risks — CISA does not add entries to the KEV catalog without confirmed in-the-wild exploitation evidence.

SonicWall SMA1000 Appliances carry two simultaneous entries this cycle. CVE-2026-83548 is a server-side request forgery (SSRF) flaw enabling unauthenticated remote access to sensitive functionality — a classic pivot point for lateral movement into segmented networks. CVE-2026-83549 compounds this: an OS command injection flaw granting authenticated administrators arbitrary code execution. In combination, these flaws form a two-stage chain: SSRF to gain access or session context, command injection to achieve RCE. Organizations using SMA1000 as their remote access gateway — a common configuration in federal and defense contractor environments — should treat these as a pair. If patching cannot be completed today, isolate the appliance from direct internet exposure immediately, enforce network-level access controls, and audit administrator accounts for unauthorized additions.

JFrog Artifactory (CVE-2026-82329) is equally alarming. Under default configurations, an unauthenticated attacker with network access can obtain administrative privileges — effectively full control over your artifact management plane. For organizations using Artifactory as the backbone of their software supply chain, this is a supply-chain integrity incident waiting to happen. A compromised Artifactory instance means poisoned build artifacts, tampered dependencies, and potential downstream impact to every application built against that repository. Patch immediately; if delayed, disable anonymous access, rotate all service account credentials, and audit recent artifact uploads for signs of tampering.

Sangoma Switchvox (CVE-2026-9586) rounds out the September 5 cluster with a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements against the backend PostgreSQL database, including remote code execution. VoIP infrastructure is historically undertreated in vulnerability management programs. Organizations running Switchvox should apply vendor patches today, restrict administrative interfaces to trusted network segments, and review PostgreSQL logs for anomalous query patterns dating back at least 30 days.

Kestra OSS (CVE-2026-49869) also expires today. An unauthenticated remote attacker can create and execute arbitrary workflows without credentials. For organizations running Kestra in CI/CD or data pipeline environments, this is a full pre-auth RCE condition. If Kestra instances are publicly reachable, take them offline or place them behind a VPN/zero-trust gateway until patched.

Developer Toolchain and AI Middleware: A Broader Supply-Chain Exposure

Three entries added September 2 with a September 16 deadline target the increasingly complex layer of Python-based web frameworks, AI gateway middleware, and HTTP infrastructure that underpins modern DevOps and AI deployments.

Kludex Starlette (CVE-2026-48710) contains an HTTP request/response smuggling vulnerability enabling path injection into the host field, which can bypass authentication systems that rely on the reconstructed URL's path for access control decisions. Critically, CISA flags this as chainable with CVE-2026-42271, suggesting active exploitation may already involve multi-step attack chains. Any application sitting behind a Starlette-based layer — particularly FastAPI deployments, which use Starlette as a foundation — should be assessed for exposure. Review your reverse proxy configurations and ensure authentication logic does not rely solely on URL path reconstruction.

BerriAI LiteLLM (CVE-2026-59822) exposes a fundamental authentication failure in its MCP Streamable HTTP endpoint: an unauthenticated attacker can establish a fully authenticated MCP session using any arbitrary Bearer token. For organizations routing sensitive AI workloads — including those touching proprietary data or production model inference — through LiteLLM, this means unauthorized actors could interact with your AI infrastructure with legitimate session privileges. Rotate all API keys and Bearer tokens after patching, and audit MCP session logs for anomalous access patterns.

Browser Attack Surface: Chromium V8 Demands Rapid Endpoint Coverage

CVE-2026-85046, added today with a September 18 deadline, is a type confusion vulnerability in Google Chromium V8 enabling remote code execution inside the sandbox via a crafted HTML page. The cross-browser blast radius is significant — Google Chrome, Microsoft Edge, and Opera are all affected given their shared Chromium lineage. Spear-phishing campaigns and malvertising chains routinely weaponize V8 flaws within days of KEV listing. Prioritize browser patch deployment through your endpoint management tooling this weekend; do not wait for standard patch cycles. Verify auto-update enforcement across managed endpoints and validate browser versions in your asset inventory before Monday.

Compliance Posture and Recommended Actions

| Deadline | CVEs | Status | |---|---|---| | September 5 | CVE-2026-49869, CVE-2026-82329, CVE-2026-83548, CVE-2026-83549, CVE-2026-9586 | Critical — Expires Today | | September 16 | CVE-2026-48710, CVE-2026-59822 | Urgent — 12 days | | September 18 | CVE-2026-85046 | Urgent — 14 days |

All entries fall under BOD 26-04 obligations for federal agencies and scoped contractors. Where patches are unavailable or operationally delayed, document compensating controls, escalate exceptions per your agency's process, and ensure forensic triage readiness in accordance with CISA's published requirements. Internet exposure assessments are mandatory — not optional — before claiming compliance.

Sources: CISA KEV Catalog · SonicWall Security Advisories · JFrog Security Advisory · Google Chrome Releases · CISA BOD 26-04 · Kestra Security Disclosures · BerriAI LiteLLM Advisories

Free KEV Alerts

  • Real-time notification the moment a KEV drops
  • Vendor and product details
  • BOD 26-04 remediation deadline included

Pro Alerts Coming Soon

  • Real-time notification the moment a KEV drops
  • Filtered to your specific vendor watchlist
  • Urgency scoring (Critical / Urgent / Standard)
  • Direct patch links included

Stay ahead of CISA.

No spam. Unsubscribe anytime. We don't sell your data.


Upcoming Patch Due Dates

via Binding Operational Directive 26-04

BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.

Loading...

News Logo

Cyber Security News

You may have missed...


Hacking Editorial Brief — September 8, 2026

White-Hat Hackers Return Most of Liquid Network Bitcoin

In a significant development to yesterday's $320 million Liquid Network breach, the self-described white-hat hackers have returned approximately 3,400 of the 4,000 stolen bitcoin after Blockstream patched the exploited bridge vulnerability. Nearly 600 BTC—worth roughly $47 million—remains with the attackers. The partial return follows Blockstream's remediation of the underlying flaw, though neither the company nor the attackers have disclosed technical details of the vulnerability. The incident continues to underscore security challenges in cryptocurrency bridge infrastructure as the industry seeks institutional legitimacy.

Multiple Active Exploitation Campaigns Target Enterprise Infrastructure

Threat actors are exploiting recently disclosed vulnerabilities across several enterprise platforms in coordinated campaigns. Attackers are actively chaining two MikroTik RouterOS flaws to hijack routers with exposed SSH services, building on exploitation activity confirmed since September 2. Separately, researchers disclosed worm-like activity abusing ConnectWise ScreenConnect installations to distribute a four-stage VBScript payload that spreads to newly connected hosts, enabling lateral movement across managed environments. N-able has released its fourth hotfix in five weeks for CVE-2026-86218, a CVSS 10.0 unauthenticated remote code execution vulnerability in N-central, with incident reports indicating active exploitation in the wild. The overlapping campaigns demonstrate sustained opportunistic targeting of remote management and network infrastructure.

North Korean Operators Conceal Backdoor in HAProxy Load Balancers

North Korea-linked threat actors have deployed a sophisticated backdoor hidden within HAProxy load balancer installations, masking command-and-control traffic while maintaining normal load balancing functionality. The technique allows attackers to exfiltrate data through legitimate-appearing network traffic, complicating detection efforts. Technical implementation details and affected versions have not been publicly disclosed.

Sources: CoinDesk · Bleeping Computer · The Hacker News · Security Affairs

📌 Pinned

*

https:betanews.comMar 5

Inside a cyberattack: How hackers steal data

The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...

https://www.nytimes.comSep 8

A.I. Models Built a Computer Worm That Could Rapidly Hack WeChat Accounts

Dustin Volz covers cybersecurity and intelligence, and reported from Washington. Sept. 8, 2026, 5:05 a.m. ET.

https://finance.yahoo.comSep 8

Hackers Return 85% of Stolen Bitcoin from Last Week's Bridge Attack - Yahoo Finance

The Liquid hackers returned 3400 Bitcoin after Blockstream patched the bridge, but nearly 600 BTC stays with the attackers.

https://securityaffairs.comSep 8

IT Help Desk Impersonation Lets Hackers Bypass MFA - Security Affairs

Attackers bypass endpoint security by posing as IT staff, stealing Microsoft 365 sessions, draining SaaS data and demanding extortion.

https://www.wfmd.comSep 8

If hackers cripple America's water, the consequences could be catastrophic - 930 WFMD

Foreign adversaries from Iran, China, and Russia are actively targeting America's water infrastructure, exploiting aging industrial control ...

https://www.nytimes.comSep 8

A.I. Models Built a Computer Worm That Could Rapidly Hack WeChat Accounts

The attack, discovered by A.I. researchers, could have compromised hundreds of millions of devices within hours, experts said.

https://www.rapid7.comSep 1

PaperCut NG/MF Critical Zero-Day Exploited in the Wild

Threat actors are exploiting newly disclosed PaperCut NG and MF flaws (CVE-2026-81578 and CVE-2026-82078) to facilitate credential theft in attacks ta...

https://www.yahoo.comSep 6

Hackers Demand $2 Million in Bitcoin from Germany. Berlin Refuses to Pay - Yahoo

Berlin's state government refused a 30 Bitcoin ransom, and the hackers behind the attack published 5.7 terabytes of stolen data on the dark web.

https://www.mprnews.orgSep 6

Winona County paid $128K ransom after cyberattack; then was attacked again - MPR News

The report indicates that 269 public entities and government contractors in Minnesota reported possible cybersecurity incidents last year. Rochester ....


Updated daily