CISA stopped reliably sending KEV alerts.
We didn't.
CyberComply monitors the CISA Known Exploited Vulnerabilities catalog 24/7 and alerts you the moment a new KEV drops — before the deadline clock starts ticking without you knowing.
KEV Intelligence Brief — September 4, 2026
Prepared by: Cybersecurity Intelligence | Distribution: Federal Contractors, DevOps, SecOps Leadership Brief Date: Friday, September 4, 2026 | Catalog Additions Covered: 8 CVEs added September 2–4, 2026
CISA's latest KEV additions paint a consistent and urgent picture: attackers are actively exploiting foundational infrastructure — network access appliances, artifact repositories, workflow automation platforms, and AI middleware — while continuing to weaponize browser-side execution vectors. Five of the eight entries carry patch deadlines of September 5, meaning federal agencies and BOD 26-04-scoped contractors are, as of this brief, operating with fewer than 24 hours of compliance runway on the most critical entries. Treat this cycle as a red-letter event.
Immediate Action Required: Perimeter and Infrastructure at Critical Risk
Four vulnerabilities share a September 5 patch deadline and collectively represent unauthenticated or near-unauthenticated pathways to full system compromise on internet-facing infrastructure. These are not theoretical risks — CISA does not add entries to the KEV catalog without confirmed in-the-wild exploitation evidence.
SonicWall SMA1000 Appliances carry two simultaneous entries this cycle. CVE-2026-83548 is a server-side request forgery (SSRF) flaw enabling unauthenticated remote access to sensitive functionality — a classic pivot point for lateral movement into segmented networks. CVE-2026-83549 compounds this: an OS command injection flaw granting authenticated administrators arbitrary code execution. In combination, these flaws form a two-stage chain: SSRF to gain access or session context, command injection to achieve RCE. Organizations using SMA1000 as their remote access gateway — a common configuration in federal and defense contractor environments — should treat these as a pair. If patching cannot be completed today, isolate the appliance from direct internet exposure immediately, enforce network-level access controls, and audit administrator accounts for unauthorized additions.
JFrog Artifactory (CVE-2026-82329) is equally alarming. Under default configurations, an unauthenticated attacker with network access can obtain administrative privileges — effectively full control over your artifact management plane. For organizations using Artifactory as the backbone of their software supply chain, this is a supply-chain integrity incident waiting to happen. A compromised Artifactory instance means poisoned build artifacts, tampered dependencies, and potential downstream impact to every application built against that repository. Patch immediately; if delayed, disable anonymous access, rotate all service account credentials, and audit recent artifact uploads for signs of tampering.
Sangoma Switchvox (CVE-2026-9586) rounds out the September 5 cluster with a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements against the backend PostgreSQL database, including remote code execution. VoIP infrastructure is historically undertreated in vulnerability management programs. Organizations running Switchvox should apply vendor patches today, restrict administrative interfaces to trusted network segments, and review PostgreSQL logs for anomalous query patterns dating back at least 30 days.
Kestra OSS (CVE-2026-49869) also expires today. An unauthenticated remote attacker can create and execute arbitrary workflows without credentials. For organizations running Kestra in CI/CD or data pipeline environments, this is a full pre-auth RCE condition. If Kestra instances are publicly reachable, take them offline or place them behind a VPN/zero-trust gateway until patched.
Developer Toolchain and AI Middleware: A Broader Supply-Chain Exposure
Three entries added September 2 with a September 16 deadline target the increasingly complex layer of Python-based web frameworks, AI gateway middleware, and HTTP infrastructure that underpins modern DevOps and AI deployments.
Kludex Starlette (CVE-2026-48710) contains an HTTP request/response smuggling vulnerability enabling path injection into the host field, which can bypass authentication systems that rely on the reconstructed URL's path for access control decisions. Critically, CISA flags this as chainable with CVE-2026-42271, suggesting active exploitation may already involve multi-step attack chains. Any application sitting behind a Starlette-based layer — particularly FastAPI deployments, which use Starlette as a foundation — should be assessed for exposure. Review your reverse proxy configurations and ensure authentication logic does not rely solely on URL path reconstruction.
BerriAI LiteLLM (CVE-2026-59822) exposes a fundamental authentication failure in its MCP Streamable HTTP endpoint: an unauthenticated attacker can establish a fully authenticated MCP session using any arbitrary Bearer token. For organizations routing sensitive AI workloads — including those touching proprietary data or production model inference — through LiteLLM, this means unauthorized actors could interact with your AI infrastructure with legitimate session privileges. Rotate all API keys and Bearer tokens after patching, and audit MCP session logs for anomalous access patterns.
Browser Attack Surface: Chromium V8 Demands Rapid Endpoint Coverage
CVE-2026-85046, added today with a September 18 deadline, is a type confusion vulnerability in Google Chromium V8 enabling remote code execution inside the sandbox via a crafted HTML page. The cross-browser blast radius is significant — Google Chrome, Microsoft Edge, and Opera are all affected given their shared Chromium lineage. Spear-phishing campaigns and malvertising chains routinely weaponize V8 flaws within days of KEV listing. Prioritize browser patch deployment through your endpoint management tooling this weekend; do not wait for standard patch cycles. Verify auto-update enforcement across managed endpoints and validate browser versions in your asset inventory before Monday.
Compliance Posture and Recommended Actions
| Deadline | CVEs | Status | |---|---|---| | September 5 | CVE-2026-49869, CVE-2026-82329, CVE-2026-83548, CVE-2026-83549, CVE-2026-9586 | Critical — Expires Today | | September 16 | CVE-2026-48710, CVE-2026-59822 | Urgent — 12 days | | September 18 | CVE-2026-85046 | Urgent — 14 days |
All entries fall under BOD 26-04 obligations for federal agencies and scoped contractors. Where patches are unavailable or operationally delayed, document compensating controls, escalate exceptions per your agency's process, and ensure forensic triage readiness in accordance with CISA's published requirements. Internet exposure assessments are mandatory — not optional — before claiming compliance.
Sources: CISA KEV Catalog · SonicWall Security Advisories · JFrog Security Advisory · Google Chrome Releases · CISA BOD 26-04 · Kestra Security Disclosures · BerriAI LiteLLM Advisories
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — September 4, 2026
U.S. Government Dismantles Chinese Hacking Infrastructure Targeting Critical Systems
The Department of Justice and FBI seized two hacking platforms—QScan and QTRouter—used by Chinese state-sponsored threat actors to target U.S. critical infrastructure. Court documents filed in the Southern District of California detail the operation, though specific targets and the extent of compromise have not been publicly disclosed. The seizure represents direct action against command-and-control infrastructure rather than post-breach remediation, reflecting an escalation in U.S. response posture to persistent state-sponsored intrusion campaigns. The platforms' technical capabilities and operational timeline remain under investigation.
Google Patches Actively Exploited Chrome Zero-Day in V8 Engine
Google released an emergency security update for Chrome to address CVE-2026-85046, a high-severity type confusion vulnerability in the V8 JavaScript and WebAssembly engine. The flaw is confirmed to be under active exploitation in the wild, though Google has not attributed the attacks or disclosed targets. Type confusion bugs in V8 allow attackers to corrupt memory and achieve arbitrary code execution within the browser sandbox. This marks the latest in a series of in-the-wild V8 exploits over the past year, underscoring continued threat actor focus on browser engine vulnerabilities as an initial access vector.
Sources: Presidential Prayer Team · The Hacker News
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
China Hackers Breached 361 Networks in 5 Days; CISA Sets 3-Day Patch Window for Enterprise Flaws
China-nexus hackers breached 361 organizations in 47 countries within five days of a VMware vCenter patch, while also deploying autonomous AI hacking ...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
Threat actors are leveraging the trusted Node.js JavaScript runtime to deploy malicious payloads in targeted attacks against government departments, t...
PaperCut Exploitation Escalates to Active Intrusions
Threat actors are actively exploiting two PaperCut NG/MF vulnerabilities (CVE-2026-82078 and CVE-2026-81578) with attacks escalating from reconnaissan...
Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root
Cisco disclosed CVE-2026-20212, a critical vulnerability in Nexus 9000 Series Switches with Silicon One ASICs that allows unauthenticated remote attac...
FBI takes down China-linked hacking network behind attacks on NASA, DOJ and U.S. Senate
The Justice Department and FBI seized domains tied to hacking tools QScan and QTRouter built and run by Chinese state-sponsored group QTFY that target...
NASA, Fed, Senate among Chinese hackers' targets, Justice Department says
The DOJ announced it disrupted a Chinese hacking operation by Nanjing Xinjiuwei Network Technology Company targeting NASA, the Federal Reserve, and ot...
US Says China-Linked Hackers Targeted NASA, Fed and Senate
The US Justice Department and FBI disrupted online infrastructure allegedly used by Chinese state-sponsored hackers to target American government agen...
FBI seizes China-linked hacking platforms QScan and QTRouter used to target U.S. critical infrastructure
The U.S. Department of Justice and FBI seized two platforms used by a China-linked group to hide cyberattacks and target critical infrastructure since...
Updated daily