CISA Adds Seven Known Exploited Vulnerabilities to Catalog (CVE-2026-9586, CVE-2026-48710, CVE-2026-49869 +4 more)

What Happened

The US Cybersecurity and Infrastructure Security Agency (CISA) added seven security flaws to a list of vulnerabilities known to be actively exploited by attackers. These flaws affect various software products, including communication systems, web frameworks, and security appliances. Organizations using the affected products should prioritize applying security updates to prevent attackers from compromising their systems. Federal agencies are mandated to fix these issues, but CISA advises all organizations to do the same.

Key Takeaways

• CISA added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation.
• Affected products include Sangoma Switchvox, Kludex Starlette, Kestra OSS, BerriAI LiteLLM, JFrog Artifactory, and SonicWall SMA1000 appliances.
• Vulnerability types include SQL injection, HTTP request/response smuggling, OS command injection, improper authentication, and server-side request forgery (SSRF).
• Federal Civilian Executive Branch (FCEB) agencies are required to remediate these vulnerabilities under Binding Operational Directive (BOD) 26-04.
• CISA encourages all organizations to prioritize remediation of these vulnerabilities on publicly exposed assets.

Affected Systems

• Sangoma Switchvox
• Kludex Starlette
• Kestra OSS
• BerriAI LiteLLM
• JFrog Artifactory
• SonicWall SMA1000 Appliances

Vulnerabilities (CVEs)

Attack Chain

1. Initial Access: Attackers exploit one of the seven listed vulnerabilities on an externally exposed asset.
2. Execution: Vulnerabilities like OS command injection or SQL injection allow attackers to execute arbitrary code or commands.
3. Defense Evasion/Bypass: Improper authentication or HTTP request smuggling flaws allow attackers to bypass access controls or security boundaries.
4. Persistence/Impact: Attackers gain total control of the compromised asset, enabling further network compromise or data theft.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No detection rules are provided in the article.

Detection Engineering Assessment

Required Log Sources

• Web application firewall logs
• Proxy logs
• Application logs for affected products (Sangoma Switchvox, Kestra OSS, etc.)
• SonicWall SMA1000 appliance logs

Hunting Hypotheses

Control Gaps

• Network-based IDS/IPS may miss application-specific exploitation like HTTP request smuggling if signatures are not tuned for the specific framework.
• Lack of application-level logging on appliances may prevent detection of post-exploitation activity.

Key Behavioral Indicators

• Anomalous HTTP request patterns targeting Starlette or Switchvox endpoints
• Unexpected outbound network connections from SonicWall SMA1000 appliances
• Unauthenticated access attempts or privilege escalation in Artifactory and LiteLLM audit logs

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate whether affected systems (SonicWall SMA1000, Sangoma Switchvox) should be isolated in dedicated network zones with strict access controls.
• Ensure all affected applications are updated to the latest secure versions provided by the vendors.

User Protection

• If JFrog Artifactory or BerriAI LiteLLM are used, review access logs for indicators of compromise prior to patching.
• Ensure multi-factor authentication is enforced on all externally facing administrative interfaces where supported.

Security Awareness

• Communicate the addition of these CVEs to the KEV catalog to relevant IT and development teams responsible for the affected products.
• Reinforce the importance of timely patch management for externally exposed assets.

MITRE ATT&CK Mapping