CISA Flags Seven Actively Exploited Flaws Across AI and Enterprise Systems
The Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog identifies flaws backed by evidence of real-world attacks, making them a priority for remediation. The latest warning spans firewalls, software-development infrastructure and AI control points. Gateways such as LiteLLM can hold model-provider keys, database connections and routing credentials, raising the risk that an initial breach could lead to secret theft, persistent access and abuse of computing resources.
CISA added seven vulnerabilities on Sept. 2, 2026: two affecting SonicWall SMA1000 appliances and one each in Sangoma Switchvox, JFrog Artifactory, Starlette, Kestra OSS and BerriAI LiteLLM. The Kestra command-injection flaw and SonicWall server-side request forgery carry CVSS scores of 10.0. US federal agencies face a Sept. 5 deadline for five of the flaws, while remediation of the Starlette and LiteLLM vulnerabilities is due by Sept. 16.
All Coverage
1 original reportsThe Backstory
The history behind this eventLiteLLM Vulnerability Can Be Chained Into Critical CVSS 10 Exploit
LiteLLM is an open-source proxy that integrates services from multiple large language model providers and is commonly deployed in development and enterprise AI environments. A breach of its authentication mechanism could allow attackers to seize control of backend systems, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to designate CVE-2026-42271 as a high-risk vulnerability requiring priority remediation.
CISA has added CVE-2026-42271 to its Known Exploited Vulnerabilities (KEV) catalog and ordered covered agencies to patch it by the required deadline. Security experts said the flaw can be chained with a vulnerability in the Starlette framework to completely bypass authentication and remotely execute commands, giving the overall exploit chain the maximum CVSS score of 10.
Subscribe to Mark Radar Weekly
Every Friday, the week's strongest signals in your inbox. Unsubscribe anytime.
If you search news on Google, you can set Mark Radar as a preferred source—our coverage will show up more often in your results. Set as preferred source on Google →