CISA stopped reliably sending KEV alerts.
We didn't.
CyberComply monitors the CISA Known Exploited Vulnerabilities catalog 24/7 and alerts you the moment a new KEV drops — before the deadline clock starts ticking without you knowing.
KEV Intelligence Brief — September 8, 2026
Prepared by: Security Operations Intelligence | Distribution: Federal Contractors, DevOps, SecOps Leadership
Eight vulnerabilities added to CISA's KEV catalog over the past week span e-commerce platforms, Windows system internals, managed service provider tooling, AI infrastructure, and browser engines. Taken together, they reflect three distinct threat patterns demanding tiered response: a cluster of critical deadlines already past or within days, a pair of Windows local privilege escalation flaws likely serving as post-exploitation enablers, and a set of emerging-stack vulnerabilities—workflow automation, AI gateway middleware, and Python web frameworks—that expose the modern DevOps toolchain to unauthenticated remote compromise.
Critical Deadline Cluster: Overdue Patches and 72-Hour Windows
Four of the eight entries carry patch deadlines that are either already past or expire within the next three days. These demand immediate triage, not scheduled maintenance.
CVE-2026-49869 (Kestra OSS) carried a September 5 deadline—three days ago. If your organization runs Kestra OSS and has not patched, you are operating an internet-accessible workflow orchestration engine with a confirmed unauthenticated OS command injection vulnerability. An attacker with network access can create and execute arbitrary workflows without any credentials. Treat exposed instances as potentially compromised: initiate forensic triage per CISA's BOD 26-04 Forensics Triage Requirements, rotate all service account credentials, and take the instance offline if patching is not immediately possible. This is not a theoretical risk; it is an active exploitation scenario.
CVE-2026-75650 (Adobe Commerce/Magento) and CVE-2026-86218 (N-able N-central) both carry September 11 deadlines—Thursday. The Adobe flaw is a template engine injection enabling arbitrary code execution on e-commerce storefronts, a high-value target for payment card skimming and supply-chain injection. Federal contractors running Commerce or Magento should treat any unpatched internet-facing instance as a priority-one item today. The N-able N-central vulnerability is arguably more alarming in terms of blast radius: static code injection enabling pre-authentication RCE on an RMM platform that, by design, has privileged agent access across managed endpoints. A single compromised N-central server can pivot laterally to every managed device in the estate. MSPs and federal contractors using N-central must patch before Thursday or immediately isolate the management plane from internet exposure.
Windows Privilege Escalation Pair: The Post-Exploitation Escalator
CVE-2026-81963 and CVE-2026-85880 are both Windows local privilege escalation vulnerabilities added today with a shared September 22 deadline, and they should be understood as a coupled threat.
CVE-2026-81963 exploits a link following flaw in the Windows Update Stack, allowing a local attacker to escalate to SYSTEM. CVE-2026-85880 targets Windows Advanced Local Procedure Call (ALPC) via a heap-based buffer overflow, also resulting in local privilege escalation. Neither vulnerability is an initial access vector on its own, but that framing understates the risk. In active threat campaigns, LPE flaws are chained immediately after phishing, credential theft, or initial web shell deployment. An attacker who lands with user-level access—extremely common in real intrusions—can leverage either of these to achieve SYSTEM within the same session.
The September 22 deadline gives more runway than the e-commerce and RMM entries, but organizations should not interpret that as low urgency. Prioritize patching on internet-facing Windows systems and any endpoints running EDR with incomplete coverage first. Validate that Windows Update infrastructure itself is not manipulated—ironic but relevant given CVE-2026-81963's attack surface in the Update Stack. Both flaws align with Microsoft's standard Patch Tuesday cycle, so coordinate with your patch management workflow accordingly, but do not defer past the BOD 26-04 deadline.
Developer Toolchain and AI Infrastructure: The Emerging Attack Surface
The remaining three vulnerabilities target software layers that many organizations have not yet integrated into mature vulnerability management programs.
CVE-2026-85046 (Google Chromium V8) is a type confusion vulnerability enabling sandbox-escape-level arbitrary code execution via a crafted HTML page, affecting Chrome, Edge, and Opera. Deadline is September 18. Browser patching is often treated as automatic, but verify that enterprise browser management policies are not inadvertently delaying rollout on locked-down or air-gapped workstations.
CVE-2026-48710 (Kludex Starlette) is an HTTP request/response smuggling flaw with a September 16 deadline. Its significance is amplified by a noted chaining relationship with CVE-2026-42271—when combined, the path injection can enable authentication bypass. Any Python-based web service built on Starlette or FastAPI (which depends on Starlette) should be assessed. This is particularly relevant to DevOps teams deploying microservices in Kubernetes or behind API gateways, where URL path reconstruction is a common authentication dependency.
CVE-2026-59822 (BerriAI LiteLLM) represents a new category of risk: AI gateway middleware. The improper authentication flaw in LiteLLM's MCP Streamable HTTP endpoint allows any unauthenticated attacker to establish an authenticated MCP session with an arbitrary Bearer token—effectively bypassing all token-based access controls for LLM routing infrastructure. Deadline is September 16. Organizations using LiteLLM as a unified proxy for OpenAI, Anthropic, or internal model endpoints should patch immediately and audit MCP session logs for anomalous bearer tokens. Credential rotation for all downstream LLM API keys routed through the instance is warranted.
Summary Deadlines at a Glance
| CVE | Product | Deadline | Status | |---|---|---|---| | CVE-2026-49869 | Kestra OSS | Sep 5 | OVERDUE | | CVE-2026-75650 | Adobe Commerce/Magento | Sep 11 | 72 hours | | CVE-2026-86218 | N-able N-central | Sep 11 | 72 hours | | CVE-2026-48710 | Starlette | Sep 16 | 8 days | | CVE-2026-59822 | LiteLLM | Sep 16 | 8 days | | CVE-2026-85046 | Chromium V8 | Sep 18 | 10 days | | CVE-2026-81963 | Windows Update Stack | Sep 22 | 14 days | | CVE-2026-85880 | Windows ALPC | Sep 22 | 14 days |
Sources: CISA KEV Catalog · CISA BOD 26-04 · Adobe Security Bulletin · Microsoft Security Update Guide · N-able Security Advisories · Google Chrome Releases · Kludex Starlette GitHub Advisory · Kestra Security Advisories · BerriAI LiteLLM GitHub Advisory
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — September 8, 2026
White-Hat Hackers Return Most of Liquid Network Bitcoin
In a significant development to yesterday's $320 million Liquid Network breach, the self-described white-hat hackers have returned approximately 3,400 of the 4,000 stolen bitcoin after Blockstream patched the exploited bridge vulnerability. Nearly 600 BTC—worth roughly $47 million—remains with the attackers. The partial return follows Blockstream's remediation of the underlying flaw, though neither the company nor the attackers have disclosed technical details of the vulnerability. The incident continues to underscore security challenges in cryptocurrency bridge infrastructure as the industry seeks institutional legitimacy.
Multiple Active Exploitation Campaigns Target Enterprise Infrastructure
Threat actors are exploiting recently disclosed vulnerabilities across several enterprise platforms in coordinated campaigns. Attackers are actively chaining two MikroTik RouterOS flaws to hijack routers with exposed SSH services, building on exploitation activity confirmed since September 2. Separately, researchers disclosed worm-like activity abusing ConnectWise ScreenConnect installations to distribute a four-stage VBScript payload that spreads to newly connected hosts, enabling lateral movement across managed environments. N-able has released its fourth hotfix in five weeks for CVE-2026-86218, a CVSS 10.0 unauthenticated remote code execution vulnerability in N-central, with incident reports indicating active exploitation in the wild. The overlapping campaigns demonstrate sustained opportunistic targeting of remote management and network infrastructure.
North Korean Operators Conceal Backdoor in HAProxy Load Balancers
North Korea-linked threat actors have deployed a sophisticated backdoor hidden within HAProxy load balancer installations, masking command-and-control traffic while maintaining normal load balancing functionality. The technique allows attackers to exfiltrate data through legitimate-appearing network traffic, complicating detection efforts. Technical implementation details and affected versions have not been publicly disclosed.
Sources: CoinDesk · Bleeping Computer · The Hacker News · Security Affairs
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
A.I. Models Built a Computer Worm That Could Rapidly Hack WeChat Accounts
Dustin Volz covers cybersecurity and intelligence, and reported from Washington. Sept. 8, 2026, 5:05 a.m. ET.
Hackers Return 85% of Stolen Bitcoin from Last Week's Bridge Attack - Yahoo Finance
The Liquid hackers returned 3400 Bitcoin after Blockstream patched the bridge, but nearly 600 BTC stays with the attackers.
IT Help Desk Impersonation Lets Hackers Bypass MFA - Security Affairs
Attackers bypass endpoint security by posing as IT staff, stealing Microsoft 365 sessions, draining SaaS data and demanding extortion.
If hackers cripple America's water, the consequences could be catastrophic - 930 WFMD
Foreign adversaries from Iran, China, and Russia are actively targeting America's water infrastructure, exploiting aging industrial control ...
A.I. Models Built a Computer Worm That Could Rapidly Hack WeChat Accounts
The attack, discovered by A.I. researchers, could have compromised hundreds of millions of devices within hours, experts said.
PaperCut NG/MF Critical Zero-Day Exploited in the Wild
Threat actors are exploiting newly disclosed PaperCut NG and MF flaws (CVE-2026-81578 and CVE-2026-82078) to facilitate credential theft in attacks ta...
Hackers Demand $2 Million in Bitcoin from Germany. Berlin Refuses to Pay - Yahoo
Berlin's state government refused a 30 Bitcoin ransom, and the hackers behind the attack published 5.7 terabytes of stolen data on the dark web.
Winona County paid $128K ransom after cyberattack; then was attacked again - MPR News
The report indicates that 269 public entities and government contractors in Minnesota reported possible cybersecurity incidents last year. Rochester ....
Updated daily