CISA KEV Alert: Active Exploitation of LiteLLM and Check Point Gateways (CVE-2026-42271 & CVE-2026-50751)

---
title: Potential LiteLLM Command Injection Exploitation
id: 8a2f3c9d-1e4b-4a5c-9f0d-6e7d8a9b0c1d
status: experimental
description: Detects suspicious shell processes spawned by Python/Uvicorn services, potentially indicating exploitation of CVE-2026-42271 in LiteLLM.
references:
 - https://www.cisa.gov/news-events/alerts/2026/06/08/cisa-adds-two-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/06/09
tags:
 - attack.execution
 - attack.t1059.004
logsource:
 category: process_creation
 product: linux
detection:
 selection:
   ParentImage|endswith:
     - '/python'
     - '/uvicorn'
     - '/gunicorn'
   Image|endswith:
     - '/sh'
     - '/bash'
     - '/zsh'
   CommandLine|contains:
     - 'curl'
     - 'wget'
     - 'nc '
     - 'chmod'
 condition: selection
falsepositives:
 - Legitimate administrative debugging
level: high
---
title: Check Point Gateway Anomalous Management Access
id: 9b3e4d0e-2f5c-5b6d-0a1e-7f8e9a0b1c2d
status: experimental
description: Detects potential authentication bypass on Check Point gateways (CVE-2026-50751) by identifying administrative logins or policy changes without preceding successful MFA or standard auth sequences.
references:
 - https://www.cisa.gov/news-events/alerts/2026/06/08/cisa-adds-two-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/06/09
tags:
 - attack.initial_access
 - attack.t1078
logsource:
 product: checkpoint
 service: vpn
 definition: 'Requirements: Check Point logs via Syslog/CEF'
detection:
 selection_admin:
   product: 'Check Point'
   action: 'accept'
   service:
     - 'management'
     - 'cpd'
   severity|contains: 'critical'
 filter_legit:
   src_ip|cidr:
     - '10.0.0.0/8'
     - '192.168.0.0/16'
     - '172.16.0.0/12'
 condition: selection_admin and not filter_legit
falsepositives:
 - Legitimate remote admin from unknown trusted IP
level: high

// Hunt for LiteLLM Command Injection (Linux Syslog/CEF)
// Look for Python parents spawning shells or network tools
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName has_any ("python", "uvicorn", "gunicorn")
| where FileName in~ ("sh", "bash", "zsh", "nc", "curl", "wget", "python3")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, CommandLine, FileName
| extend CheckString = coalesce(InitiatingProcessCommandLine, "")
| where CheckString matches regex "litellm|LiteLLM"
;

// Hunt for Check Point Gateway Auth Bypass or Anomalous VPN/Management Access
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor == "Check Point"
| where DeviceProduct in~ ("VPN-1", "Security Gateway", "Quantum Security Management")
| where Activity == "Login" or EventOriginalMessage contains "accept"
| where RequestURL contains "/webui" or DestinationPort == 18264 or DestinationPort == 443
| parse SourceUserName with * "@" Domain 
| summarize count() by SourceIP, DestinationUserName, Activity
| where count_ < 5 // Filter out noise, focus on low-frequency anomalies often associated with attacks

-- Hunt for suspicious processes spawned by LiteLLM or Python services
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, PPid
FROM pslist()
WHERE Name IN ('sh', 'bash', 'dash', 'python', 'perl')
  AND PPid IN (SELECT Pid FROM pslist() WHERE Name IN ('python', 'uvicorn', 'gunicorn', 'litellm'))
  AND CommandLine =~ '(curl|wget|chmod|chattr|base64)'

#!/bin/bash
# Remediation Audit for CVE-2026-42271 (LiteLLM) and CVE-2026-50751 (Check Point)

# 1. Check for LiteLLM processes
LITELLM_PROCS=$(ps aux | grep -E '[l]itellm|[u]vicorn.*litellm')
if [ -n "$LITELLM_PROCS" ]; then
    echo "[WARNING] LiteLLM processes detected. Verify version is > 1.50.0 (Placeholder: Check Vendor Advisory)."
    echo "$LITELLM_PROCS"
else
    echo "[INFO] No LiteLLM processes detected."
fi

# 2. Hunt for active reverse shells (indicators of compromise)
# Look for established connections to suspicious high ports or common C2 ports
netstat -antp 2>/dev/null | grep ESTABLISHED | awk '{print $7}' | cut -d'/' -f1 | sort -u > /tmp/pids.txt
while read pid; do
    if [ -n "$pid" ]; then
        CMD=$(cat /proc/$pid/cmdline 2>/dev/null | tr '\0' ' ')
        if [[ "$CMD" == *"/sh"* ]] || [[ "$CMD" == *"/bash"* ]]; then
            echo "[ALERT] Potential shell backdoor found in PID: $pid -> $CMD"
            # Uncomment to kill: kill -9 $pid
        fi
    fi
done < /tmp/pids.txt

# 3. Check Point Gateway Indicator (Requires Gaia CLI)
# This checks for recent users added, a common post-exploitation step for auth bypass
if command -v cpprod_util &> /dev/null; then
    echo "[INFO] Check Point system detected. Manual review of 'fw tab -t user_table -f' recommended to identify unauthorized users."
fi

# 4. Check Kernel Parameters for potential exploitation artifacts
# (Generic hardening check)
if [ -f /proc/sys/kernel/dmesg_restrict ]; then
    echo "[INFO] dmesg restrict is set."
else
    echo "[WARN] dmesg_restrict is not set. Kernel logs accessible to non-root users."
fi