CISA KEV Alert: Seven CVE-2026 Vulnerabilities Under Active Exploitation — Detection and Remediation Guide for SonicWall, JFrog, Sangoma, LiteLLM, Kestra, and Starlette

On September 2, 2026, CISA added seven vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active exploitation in the wild. This is not a theoretical advisory cycle — KEV inclusion means adversaries are using these flaws against real targets right now. The additions span perimeter appliances, developer infrastructure, AI orchestration platforms, and unified communications systems:

• CVE-2026-9586 — Sangoma Switchvox SQL Injection
• CVE-2026-48710 — Kludex Starlette HTTP Request/Response Smuggling
• CVE-2026-49869 — Kestra OSS OS Command Injection
• CVE-2026-59822 — BerriAI LiteLLM Improper Authentication
• CVE-2026-82329 — JFrog Artifactory Improper Authentication
• CVE-2026-83548 — SonicWall SMA1000 Appliances Server-Side Request Forgery (SSRF)
• CVE-2026-83549 — SonicWall SMA1000 Appliances OS Command Injection

The pairing of the two SonicWall SMA1000 flaws is particularly concerning. An SSRF primitive chained with OS command injection on an SSL VPN/access gateway is a classic full-compromise pathway for a perimeter device — and perimeter devices remain the highest-value initial access targets in ransomware and nation-state intrusions. If you operate any of the affected products, treat this as a patch-now event, not a patch-cycle event.

Technical Analysis

SonicWall SMA1000 — CVE-2026-83548 (SSRF) and CVE-2026-83549 (OS Command Injection)

The SMA1000 series is SonicWall's secure mobile access appliance line. CVE-2026-83548 allows an attacker to coerce the appliance into making server-side requests to arbitrary destinations — enabling internal network reconnaissance, access to link-local metadata endpoints, and pivoting into otherwise unreachable segments. CVE-2026-83549 permits injection of operating system commands into the appliance's underlying shell. Chained together, these provide unauthenticated or low-privilege remote code execution on an internet-facing gateway. Defenders should assume that an exploited SMA appliance means the adversary has a foothold inside the network boundary with visibility into authenticated VPN sessions.

JFrog Artifactory — CVE-2026-82329 (Improper Authentication)

Artifactory sits at the center of the software supply chain. Improper authentication flaws here are a supply-chain compromise multiplier: an attacker who bypasses authentication can poison artifacts, inject malicious dependencies into builds, or exfiltrate proprietary code and signing material. This is the same class of weakness that has historically preceded build-pipeline compromises.

BerriAI LiteLLM — CVE-2026-59822 (Improper Authentication)

LiteLLM is a proxy/gateway layer widely deployed in front of LLM APIs. Improper authentication on this component exposes API keys, model endpoints, prompt logs (often containing sensitive data), and provides a pivot point into AI infrastructure. Given the speed at which AI gateways are being stood up — frequently internet-exposed with weak hardening — this CVE will see broad opportunistic exploitation.

Kestra OSS — CVE-2026-49869 (OS Command Injection)

Kestra is an open-source workflow orchestration platform. Command injection in an orchestration engine is severe by design: these platforms exist to execute tasks, often with elevated credentials against cloud and on-prem infrastructure. Successful exploitation inherits the orchestrator's privileges and integrations.

Sangoma Switchvox — CVE-2026-9586 (SQL Injection)

Switchvox is a VoIP/UC PBX platform. SQL injection against the web interface can expose call detail records, credentials, and voicemail data, and frequently serves as a stepping stone to command execution on the underlying Asterisk-based host. VoIP infrastructure is a long-favored target for toll fraud and initial access brokers.

Starlette — CVE-2026-48710 (HTTP Request/Response Smuggling)

Starlette is the ASGI framework underpinning FastAPI and a large share of Python API services. Request smuggling here undermines front-end/back-end request boundary agreement, enabling cache poisoning, credential hijacking via smuggled requests, and WAF bypass. Because Starlette is a library rather than an appliance, exposure is measured in downstream applications — you must inventory dependencies, not just servers.

Exploitation status: All seven CVEs are confirmed actively exploited per CISA's KEV listing. Federal civilian agencies are bound by BOD 22-01 remediation deadlines; private-sector organizations should apply the same urgency.

Detection & Response

The detections below target post-exploitation and exploitation behaviors common to these vulnerability classes: web service processes spawning shells (command injection), outbound connections from perimeter appliances and application servers (SSRF callbacks and C2), and anomalous requests to administrative endpoints. Tune threshold fields to your baseline before production deployment.

---
title: Web Service Process Spawning Shell — Command Injection Indicator
id: 8f2b6c41-3d5e-4a97-b821-6c9d0e2f4a17
status: experimental
description: Detects web application and orchestration service processes (Java for Artifactory/Kestra, Python for LiteLLM/Starlette, PHP/Apache for Switchvox) spawning shell or interpreter processes, consistent with OS command injection exploitation such as CVE-2026-49869 and CVE-2026-83549.
references:
  - https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/02
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
      - '/python'
      - '/python3'
      - '/php-fpm'
      - '/httpd'
      - '/apache2'
      - '/node'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Orchestration platforms like Kestra legitimately execute shell tasks; baseline known workflow executions and alert on deviations
  - Application health-check scripts invoked by service managers
level: high
---
title: HTTP Request Smuggling Indicators in Web Server Logs
id: 3c7a9e52-1b48-4f26-9d35-8e1b2c6a0f94
status: experimental
description: Detects requests containing conflicting Content-Length and Transfer-Encoding headers or smuggling-associated malformed header sequences, consistent with exploitation of CVE-2026-48710 (Starlette request/response smuggling).
references:
  - https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/02
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
    c-uri|contains:
      - '%0d%0a'
      - '%0D%0A'
      - 'Transfer-Encoding'
  condition: selection
falsepositives:
  - URL-encoded CRLF in legitimate form submissions is rare but possible; investigate in context of source IP and endpoint
level: medium

// Hunt for anomalous outbound connections from application servers and appliance
// service accounts consistent with SSRF callbacks / post-exploitation C2
// (CVE-2026-83548, CVE-2026-59822, CVE-2026-82329).
// Scope the RemoteIP filter to your actual Artifactory, Kestra, LiteLLM, and SMA hosts.
let lookback = 7d;
let infra_hosts = dynamic(["artifactory", "kestra", "litellm", "sma", "switchvox"]);
DeviceNetworkEvents
| where Timestamp >= ago(lookback)
| where DeviceName has_any (infra_hosts)
| where ActionType == "ConnectionSuccess"
| where RemoteIPType == "Public"
| where InitiatingProcessFileName in~ ("java", "python", "python3", "php-fpm", "node", "sh", "bash", "curl", "wget")
| summarize ConnectionCount = count(), DistinctRemoteIPs = dcount(RemoteIP),
    SampleRemoteIPs = make_set(RemoteIP, 10), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where DistinctRemoteIPs > 5 or ConnectionCount > 100
| sort by DistinctRemoteIPs desc;

-- Velociraptor hunt: identify shell/interpreter child processes spawned by web
-- and orchestration service processes on Linux hosts hosting Artifactory,
-- Kestra, LiteLLM, Starlette apps, or Switchvox.
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Exe =~ '(java|python|php-fpm|node)'
       AND Name =~ '(sh|bash|dash|curl|wget|nc|ncat|perl)')
   OR (CommandLine =~ '(curl|wget).*(http|ftp)://'
       AND Username =~ '(artifactory|kestra|litellm|www-data|apache|asterisk)')
ORDER BY CreateTime DESC

#!/bin/bash
# KEV triage script: verify exposure and hunting prerequisites for the
# 2026-09-02 CISA KEV additions. Run on application hosts.
# NOTE: patching MUST follow vendor advisories; this script verifies and hardens.

echo "=== [1] Starlette dependency exposure (CVE-2026-48710) ==="
pip list 2>/dev/null | grep -i starlette || echo "Starlette not found in default env — check virtualenvs and containers."
find / -name "METADATA" -path "*starlette*" 2>/dev/null | head -5

echo "=== [2] LiteLLM deployment check (CVE-2026-59822) ==="
pip list 2>/dev/null | grep -i litellm || echo "LiteLLM not found locally — check container images: docker images | grep litellm"
docker ps --format '{{.Image}}' 2>/dev/null | grep -i litellm

echo "=== [3] Outbound connection audit from service accounts (SSRF / C2 hunt) ==="
ss -tnp 2>/dev/null | grep -E "(java|python|php|node)" | head -20

echo "=== [4] Recent shell execution by web service users ==="
journalctl -u apache2 -u php-fpm -u asterisk --since "72 hours ago" 2>/dev/null | grep -iE "(sh -c|/bin/bash|curl |wget )" | tail -20

echo "=== [5] Block link-local metadata access from app hosts (SSRF mitigation) ==="
# Prevents SSRF callbacks to cloud metadata endpoints while patching is staged
iptables -C OUTPUT -d 169.254.169.254 -j DROP 2>/dev/null || \
  iptables -A OUTPUT -d 169.254.169.254 -j DROP && echo "Metadata endpoint egress blocked."

echo "=== [6] SonicWall SMA1000 / Artifactory / Switchvox / Kestra ==="
echo "Appliance and platform patches require vendor packages. Verify versions against:"
echo " - SonicWall PSIRT: https://psirt.global.sonicwall.com/"
echo " - JFrog release notes: https://jfrog.com/help/r/jfrog-release-information/"
echo " - Sangoma security advisories: https://www.sangoma.com/security-advisories/"
echo " - Kestra releases: https://github.com/kestra-io/kestra/releases"

Remediation

1. Apply vendor patches immediately. Consult the official advisories: SonicWall PSIRT for both SMA1000 CVEs, JFrog release notes for Artifactory, Sangoma security advisories for Switchvox, Kestra GitHub releases, LiteLLM GitHub releases, and the Starlette project releases. Confirm exact fixed version numbers against each advisory before scheduling change windows — do not assume your currently installed version predates the fix.
2. Honor CISA KEV deadlines. Federal agencies must remediate per BOD 22-01 due dates listed in the KEV Catalog. Private organizations should adopt the same due date as an internal SLA — CISA sets these based on observed exploitation tempo.
3. If patching is delayed, reduce exposure: place SMA1000 management interfaces behind allow-listed VPN or jump access only; restrict Artifactory and LiteLLM to authenticated internal networks with no direct internet ingress; enforce egress filtering on application hosts to blunt SSRF (deny link-local and RFC1918 destinations from DMZ workloads unless explicitly required).
4. Hunt retroactively. KEV inclusion means exploitation predates the listing. Review web access logs, process telemetry, and outbound connection data for the past 30–90 days using the queries above. On Artifactory, audit user creation, permission changes, and recently modified artifacts. On Switchvox, review CDRs and admin access logs.
5. Assume breach on internet-facing appliances. For any SMA1000 that was unpatched and internet-exposed, rotate credentials that transited the appliance, inspect for persistence mechanisms, and consider IR engagement before returning it to service.
6. Inventory your software dependencies. The Starlette CVE affects applications, not a standalone server. Generate an SBOM for Python services to locate every FastAPI/Starlette deployment in your estate.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub