CISA Adds Seven Actively Exploited Vulnerabilities to KEV Catalog – Immediate Risk for Public‑Facing Assets

CISA Adds Seven Actively Exploited Vulnerabilities to KEV Catalog – Immediate Risk for Public‑Facing Assets

What It Is – The Cybersecurity and Infrastructure Security Agency (CISA) announced that seven CVEs have been added to its Known Exploited Vulnerabilities (KEV) catalog. All seven show evidence of active exploitation in the wild.

Exploitability – Each CVE is confirmed to be exploited in the wild; CISA’s KEV inclusion criteria require publicly observable attacks.

Affected Products –

• CVE‑2026‑9586 – Sangoma Switchvox (SQL injection)
• CVE‑2026‑48710 – Kludex Starlette (HTTP request/response smuggling)
• CVE‑2026‑49869 – Kestra OSS (OS command injection)
• CVE‑2026‑59822 – BerriAI LiteLLM (improper authentication)
• CVE‑2026‑82329 – JFrog Artifactory (improper authentication)
• CVE‑2026‑83548 – SonicWall SMA1000 (server‑side request forgery)
• CVE‑2026‑83549 – SonicWall SMA1000 (OS command injection)

Why It Matters for Trust & Control Assurance

• Control Objective – Vulnerability Management & Remediation – Demonstrates the need for continuous discovery, risk‑based prioritization, and documented remediation, a control that maps to many frameworks (e.g., NIST CSF 2.0 Identify & Protect).
• Audit‑Ready Evidence – Timely patching of KEV items provides defensible proof of due diligence for regulators and enterprise auditors.
• Supply‑Chain Risk – Several of the affected products are widely used in third‑party services; unmanaged flaws can cascade into downstream contracts and breach vendor‑risk obligations.

Recommended Actions

1. Run an asset‑inventory sweep to locate any public‑facing instances of the seven products.
2. Prioritize patching or mitigation in line with CISA’s Binding Operational Directive 26‑04.
3. Capture remediation tickets, patch logs, and verification scans as evidence for your control‑assurance repository.

Source: CISA Advisory – 7 New KEV Additions (Sep 2026)