KEV Intelligence Brief — September 4, 2026

Prepared by: Cybersecurity Intelligence | Distribution: Federal Contractors, DevOps, SecOps Leadership Brief Date: Friday, September 4, 2026 | Catalog Additions Covered: 8 CVEs added September 2–4, 2026

CISA's latest KEV additions paint a consistent and urgent picture: attackers are actively exploiting foundational infrastructure — network access appliances, artifact repositories, workflow automation platforms, and AI middleware — while continuing to weaponize browser-side execution vectors. Five of the eight entries carry patch deadlines of September 5, meaning federal agencies and BOD 26-04-scoped contractors are, as of this brief, operating with fewer than 24 hours of compliance runway on the most critical entries. Treat this cycle as a red-letter event.

Immediate Action Required: Perimeter and Infrastructure at Critical Risk

Four vulnerabilities share a September 5 patch deadline and collectively represent unauthenticated or near-unauthenticated pathways to full system compromise on internet-facing infrastructure. These are not theoretical risks — CISA does not add entries to the KEV catalog without confirmed in-the-wild exploitation evidence.

SonicWall SMA1000 Appliances carry two simultaneous entries this cycle. CVE-2026-83548 is a server-side request forgery (SSRF) flaw enabling unauthenticated remote access to sensitive functionality — a classic pivot point for lateral movement into segmented networks. CVE-2026-83549 compounds this: an OS command injection flaw granting authenticated administrators arbitrary code execution. In combination, these flaws form a two-stage chain: SSRF to gain access or session context, command injection to achieve RCE. Organizations using SMA1000 as their remote access gateway — a common configuration in federal and defense contractor environments — should treat these as a pair. If patching cannot be completed today, isolate the appliance from direct internet exposure immediately, enforce network-level access controls, and audit administrator accounts for unauthorized additions.

JFrog Artifactory (CVE-2026-82329) is equally alarming. Under default configurations, an unauthenticated attacker with network access can obtain administrative privileges — effectively full control over your artifact management plane. For organizations using Artifactory as the backbone of their software supply chain, this is a supply-chain integrity incident waiting to happen. A compromised Artifactory instance means poisoned build artifacts, tampered dependencies, and potential downstream impact to every application built against that repository. Patch immediately; if delayed, disable anonymous access, rotate all service account credentials, and audit recent artifact uploads for signs of tampering.

Sangoma Switchvox (CVE-2026-9586) rounds out the September 5 cluster with a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements against the backend PostgreSQL database, including remote code execution. VoIP infrastructure is historically undertreated in vulnerability management programs. Organizations running Switchvox should apply vendor patches today, restrict administrative interfaces to trusted network segments, and review PostgreSQL logs for anomalous query patterns dating back at least 30 days.

Kestra OSS (CVE-2026-49869) also expires today. An unauthenticated remote attacker can create and execute arbitrary workflows without credentials. For organizations running Kestra in CI/CD or data pipeline environments, this is a full pre-auth RCE condition. If Kestra instances are publicly reachable, take them offline or place them behind a VPN/zero-trust gateway until patched.