CISA stopped reliably sending KEV alerts.
We didn't.
CyberComply monitors the CISA Known Exploited Vulnerabilities catalog 24/7 and alerts you the moment a new KEV drops — before the deadline clock starts ticking without you knowing.
KEV Intelligence Brief — September 4, 2026
Prepared by: Cybersecurity Intelligence | Distribution: Federal Contractors, DevOps, SecOps Leadership Brief Date: Friday, September 4, 2026 | Catalog Additions Covered: 8 CVEs added September 2–4, 2026
CISA's latest KEV additions paint a consistent and urgent picture: attackers are actively exploiting foundational infrastructure — network access appliances, artifact repositories, workflow automation platforms, and AI middleware — while continuing to weaponize browser-side execution vectors. Five of the eight entries carry patch deadlines of September 5, meaning federal agencies and BOD 26-04-scoped contractors are, as of this brief, operating with fewer than 24 hours of compliance runway on the most critical entries. Treat this cycle as a red-letter event.
Immediate Action Required: Perimeter and Infrastructure at Critical Risk
Four vulnerabilities share a September 5 patch deadline and collectively represent unauthenticated or near-unauthenticated pathways to full system compromise on internet-facing infrastructure. These are not theoretical risks — CISA does not add entries to the KEV catalog without confirmed in-the-wild exploitation evidence.
SonicWall SMA1000 Appliances carry two simultaneous entries this cycle. CVE-2026-83548 is a server-side request forgery (SSRF) flaw enabling unauthenticated remote access to sensitive functionality — a classic pivot point for lateral movement into segmented networks. CVE-2026-83549 compounds this: an OS command injection flaw granting authenticated administrators arbitrary code execution. In combination, these flaws form a two-stage chain: SSRF to gain access or session context, command injection to achieve RCE. Organizations using SMA1000 as their remote access gateway — a common configuration in federal and defense contractor environments — should treat these as a pair. If patching cannot be completed today, isolate the appliance from direct internet exposure immediately, enforce network-level access controls, and audit administrator accounts for unauthorized additions.
JFrog Artifactory (CVE-2026-82329) is equally alarming. Under default configurations, an unauthenticated attacker with network access can obtain administrative privileges — effectively full control over your artifact management plane. For organizations using Artifactory as the backbone of their software supply chain, this is a supply-chain integrity incident waiting to happen. A compromised Artifactory instance means poisoned build artifacts, tampered dependencies, and potential downstream impact to every application built against that repository. Patch immediately; if delayed, disable anonymous access, rotate all service account credentials, and audit recent artifact uploads for signs of tampering.
Sangoma Switchvox (CVE-2026-9586) rounds out the September 5 cluster with a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements against the backend PostgreSQL database, including remote code execution. VoIP infrastructure is historically undertreated in vulnerability management programs. Organizations running Switchvox should apply vendor patches today, restrict administrative interfaces to trusted network segments, and review PostgreSQL logs for anomalous query patterns dating back at least 30 days.
Kestra OSS (CVE-2026-49869) also expires today. An unauthenticated remote attacker can create and execute arbitrary workflows without credentials. For organizations running Kestra in CI/CD or data pipeline environments, this is a full pre-auth RCE condition. If Kestra instances are publicly reachable, take them offline or place them behind a VPN/zero-trust gateway until patched.
Developer Toolchain and AI Middleware: A Broader Supply-Chain Exposure
Three entries added September 2 with a September 16 deadline target the increasingly complex layer of Python-based web frameworks, AI gateway middleware, and HTTP infrastructure that underpins modern DevOps and AI deployments.
Kludex Starlette (CVE-2026-48710) contains an HTTP request/response smuggling vulnerability enabling path injection into the host field, which can bypass authentication systems that rely on the reconstructed URL's path for access control decisions. Critically, CISA flags this as chainable with CVE-2026-42271, suggesting active exploitation may already involve multi-step attack chains. Any application sitting behind a Starlette-based layer — particularly FastAPI deployments, which use Starlette as a foundation — should be assessed for exposure. Review your reverse proxy configurations and ensure authentication logic does not rely solely on URL path reconstruction.
BerriAI LiteLLM (CVE-2026-59822) exposes a fundamental authentication failure in its MCP Streamable HTTP endpoint: an unauthenticated attacker can establish a fully authenticated MCP session using any arbitrary Bearer token. For organizations routing sensitive AI workloads — including those touching proprietary data or production model inference — through LiteLLM, this means unauthorized actors could interact with your AI infrastructure with legitimate session privileges. Rotate all API keys and Bearer tokens after patching, and audit MCP session logs for anomalous access patterns.
Browser Attack Surface: Chromium V8 Demands Rapid Endpoint Coverage
CVE-2026-85046, added today with a September 18 deadline, is a type confusion vulnerability in Google Chromium V8 enabling remote code execution inside the sandbox via a crafted HTML page. The cross-browser blast radius is significant — Google Chrome, Microsoft Edge, and Opera are all affected given their shared Chromium lineage. Spear-phishing campaigns and malvertising chains routinely weaponize V8 flaws within days of KEV listing. Prioritize browser patch deployment through your endpoint management tooling this weekend; do not wait for standard patch cycles. Verify auto-update enforcement across managed endpoints and validate browser versions in your asset inventory before Monday.
Compliance Posture and Recommended Actions
| Deadline | CVEs | Status | |---|---|---| | September 5 | CVE-2026-49869, CVE-2026-82329, CVE-2026-83548, CVE-2026-83549, CVE-2026-9586 | Critical — Expires Today | | September 16 | CVE-2026-48710, CVE-2026-59822 | Urgent — 12 days | | September 18 | CVE-2026-85046 | Urgent — 14 days |
All entries fall under BOD 26-04 obligations for federal agencies and scoped contractors. Where patches are unavailable or operationally delayed, document compensating controls, escalate exceptions per your agency's process, and ensure forensic triage readiness in accordance with CISA's published requirements. Internet exposure assessments are mandatory — not optional — before claiming compliance.
Sources: CISA KEV Catalog · SonicWall Security Advisories · JFrog Security Advisory · Google Chrome Releases · CISA BOD 26-04 · Kestra Security Disclosures · BerriAI LiteLLM Advisories
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — September 8, 2026
White-Hat Hackers Return Most of Liquid Network Bitcoin
In a significant development to yesterday's $320 million Liquid Network breach, the self-described white-hat hackers have returned approximately 3,400 of the 4,000 stolen bitcoin after Blockstream patched the exploited bridge vulnerability. Nearly 600 BTC—worth roughly $47 million—remains with the attackers. The partial return follows Blockstream's remediation of the underlying flaw, though neither the company nor the attackers have disclosed technical details of the vulnerability. The incident continues to underscore security challenges in cryptocurrency bridge infrastructure as the industry seeks institutional legitimacy.
Multiple Active Exploitation Campaigns Target Enterprise Infrastructure
Threat actors are exploiting recently disclosed vulnerabilities across several enterprise platforms in coordinated campaigns. Attackers are actively chaining two MikroTik RouterOS flaws to hijack routers with exposed SSH services, building on exploitation activity confirmed since September 2. Separately, researchers disclosed worm-like activity abusing ConnectWise ScreenConnect installations to distribute a four-stage VBScript payload that spreads to newly connected hosts, enabling lateral movement across managed environments. N-able has released its fourth hotfix in five weeks for CVE-2026-86218, a CVSS 10.0 unauthenticated remote code execution vulnerability in N-central, with incident reports indicating active exploitation in the wild. The overlapping campaigns demonstrate sustained opportunistic targeting of remote management and network infrastructure.
North Korean Operators Conceal Backdoor in HAProxy Load Balancers
North Korea-linked threat actors have deployed a sophisticated backdoor hidden within HAProxy load balancer installations, masking command-and-control traffic while maintaining normal load balancing functionality. The technique allows attackers to exfiltrate data through legitimate-appearing network traffic, complicating detection efforts. Technical implementation details and affected versions have not been publicly disclosed.
Sources: CoinDesk · Bleeping Computer · The Hacker News · Security Affairs
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
A.I. Models Built a Computer Worm That Could Rapidly Hack WeChat Accounts
Dustin Volz covers cybersecurity and intelligence, and reported from Washington. Sept. 8, 2026, 5:05 a.m. ET.
Hackers Return 85% of Stolen Bitcoin from Last Week's Bridge Attack - Yahoo Finance
The Liquid hackers returned 3400 Bitcoin after Blockstream patched the bridge, but nearly 600 BTC stays with the attackers.
IT Help Desk Impersonation Lets Hackers Bypass MFA - Security Affairs
Attackers bypass endpoint security by posing as IT staff, stealing Microsoft 365 sessions, draining SaaS data and demanding extortion.
If hackers cripple America's water, the consequences could be catastrophic - 930 WFMD
Foreign adversaries from Iran, China, and Russia are actively targeting America's water infrastructure, exploiting aging industrial control ...
A.I. Models Built a Computer Worm That Could Rapidly Hack WeChat Accounts
The attack, discovered by A.I. researchers, could have compromised hundreds of millions of devices within hours, experts said.
PaperCut NG/MF Critical Zero-Day Exploited in the Wild
Threat actors are exploiting newly disclosed PaperCut NG and MF flaws (CVE-2026-81578 and CVE-2026-82078) to facilitate credential theft in attacks ta...
Hackers Demand $2 Million in Bitcoin from Germany. Berlin Refuses to Pay - Yahoo
Berlin's state government refused a 30 Bitcoin ransom, and the hackers behind the attack published 5.7 terabytes of stolen data on the dark web.
Winona County paid $128K ransom after cyberattack; then was attacked again - MPR News
The report indicates that 269 public entities and government contractors in Minnesota reported possible cybersecurity incidents last year. Rochester ....
Updated daily