CISA Adds Seven Exploited Flaws: Reverse Shells, Stolen Admin Tokens and Crypto Miners
Originally reported viaThe Hacker News — “CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners” (3 September 2026) · CISA Known Exploited Vulnerabilities CatalogOn 2 September 2026, CISA added seven vulnerabilities to its Known Exploited Vulnerabilities catalog in a single batch. Batch additions are not unusual. What makes this one worth a second look is its shape: only two of the seven are classic perimeter appliances. The rest live in the build pipeline, the web framework layer, the orchestration tier and the LLM gateway — software that most vulnerability management programmes still treat as somebody else's asset class.
Read as a set, the batch describes an attack surface that has quietly shifted. The edge is still being hit, but the software that developers and AI teams stand up themselves is now producing exploited-in-the-wild CVEs at the same rate, with none of the patch discipline that has been built up around firewalls and VPN concentrators over the last decade.
What is on the list
Two SonicWall SMA 1000 issues lead the batch. CVE-2026-83548 (CVSS 10.0) is a server-side request forgery that lets an unauthenticated attacker reach functionality they should never touch; CVE-2026-83549 (CVSS 7.8) is a post-authentication OS command injection that converts administrator access into code execution on the appliance. Chained, they are a clean unauthenticated-to-RCE path against a device that sits by definition on the internet.
The remaining five cover unfamiliar ground for most patch teams. CVE-2026-9586 (CVSS 9.3) is an unauthenticated SQL injection in Sangoma Switchvox that reaches the PostgreSQL backend and can be escalated to remote code execution. CVE-2026-82329 (CVSS 9.8) is an improper authentication flaw in JFrog Artifactory where the default configuration hands administrative privileges to an unauthenticated network client. CVE-2026-49869 (CVSS 10.0) lets an unauthenticated attacker create and run arbitrary workflows in Kestra OSS — command execution by design, without credentials. CVE-2026-48710 (CVSS 6.5) is HTTP request smuggling in Kludex Starlette, where injected path content in the host component can bypass authentication wherever the URL path is what decides access. And CVE-2026-59822 (CVSS 8.8) allows an attacker to open an authenticated MCP session against Berri LiteLLM using any arbitrary Bearer token.
The post-exploitation pattern is consistent
The Switchvox and Artifactory intrusions share a recognisable sequence. Attackers land, establish a reverse shell, and mint administrative tokens so that access survives the loss of the original entry point. From there the activity turns to collection: API keys, database credentials, and enumeration of users, groups and federated access relationships — the map of what else the compromised host can reach. Persistence is established by writing to SSH authorized_keys, and the host's compute is then monetised with the XMRig cryptocurrency miner.
That last step is easy to dismiss as low-stakes opportunism. It is better read as a timing signal. Mining is what an intruder deploys once the valuable work — credential collection and persistence — is already finished. If you are detecting a miner, you are detecting the end of the intrusion, not the beginning of it, and the credentials taken earlier are already in circulation.
Why the AI infrastructure entries deserve the most attention
The LiteLLM and Kestra entries are the ones we would escalate first in most environments, for a reason that has nothing to do with their CVSS scores. An LLM gateway is a credential concentrator. It holds provider API keys, it frequently holds internal service tokens, and through MCP it is increasingly wired to tools that can read data stores and call internal APIs. An authentication bypass that accepts an arbitrary Bearer token does not just expose one service — it exposes whatever that gateway has been given permission to orchestrate.
Workflow orchestrators carry the same structural problem. Kestra exists to execute arbitrary tasks on schedule with stored credentials attached; an unauthenticated attacker who can create and run a workflow inherits the platform's entire integration surface. Both classes of software tend to be deployed by engineering or data teams, sit inside the network rather than at its edge, and are rarely enrolled in the vulnerability management programme that covers the VPN appliances in the same batch.
The Bearer token check on your LLM gateway is now a perimeter control. Inventory it like one.
— Dev Krishnamurthy, Threat Intel Researcher · Furix Feed
Working the batch
Treat CISA's federal deadlines as your own. KEV membership means confirmed exploitation, which removes the usual argument about whether a CVSS score justifies an out-of-band change window. The harder problem for most teams is not patching speed but discovery: Artifactory, Kestra, LiteLLM and Starlette-based services are unlikely to appear in a CMDB that was built around servers and endpoints. Finding them is the first task, not the second.
- Patch the two SonicWall SMA 1000 flaws (CVE-2026-83548, CVE-2026-83549) first — the SSRF plus command injection pair gives an unauthenticated path to code execution on an internet-facing device.
- Audit JFrog Artifactory against its default configuration. CVE-2026-82329 is exploitable precisely because defaults were left in place; assume compromise of any instance that has been network-reachable and unpatched.
- Inventory every LLM gateway, MCP endpoint and workflow orchestrator in the estate, including instances stood up by engineering and data teams outside the standard build process. Patch LiteLLM and Kestra, and bring both into ongoing vulnerability management scope.
- Rebuild your Starlette-based services against the fixed release and remove any authorisation logic that decides access purely from the URL path — that is the condition CVE-2026-48710 exploits.
- Hunt retrospectively rather than only patching forward. Review SSH authorized_keys files for unrecognised entries, look for outbound connections consistent with reverse shells, and check for XMRig or unexplained sustained CPU load on affected hosts.
- Rotate every credential reachable from a compromised host — API keys, database credentials, service tokens and any federated access the host was trusted for. Patching does not revoke a token that was already stolen.
Stay ahead of the threat curve
Get the latest CVE advisories, threat actor intelligence, and detection engineering posts delivered to your inbox.
