CISA Flags Seven Actively Exploited Flaws Including Three in AI Infrastructure Used for Backdoors and Miners

The agency that sets the federal government's vulnerability response schedule has added seven actively exploited flaws to its catalog in a single batch, and nearly half of them target artificial intelligence infrastructure, a sign that attackers have moved from probing AI systems to reliably breaking into the tools companies use to deploy them. CISA, the Cybersecurity and Infrastructure Security Agency, added the seven vulnerabilities to its Known Exploited Vulnerabilities catalog on September 2, 2026, according to eSecurity Planet, which noted the batch was notable because three of the seven flaws affect AI and machine learning platforms, including the LiteLLM gateway and the Kestra workflow engine. Under the federal binding operational directive that governs the catalog, agencies must patch the affected products by deadlines ranging from September 5 to September 16.

The batch captures a shift that security researchers have been warning about for months. The AI boom has created a new layer of infrastructure, gateways that route requests to models, orchestration platforms that chain AI steps into workflows, and servers that expose model capabilities over standard web protocols, and much of that infrastructure was built for speed rather than security. eSecurity Planet reported on September 2 that attackers are exploiting flaws in this layer to steal API keys, deploy reverse shells and run cryptocurrency miners, treating AI gateways as high-value targets because they hold the credentials that unlock access to frontier models and to the cloud accounts beneath them.

Key Facts

The most widely applicable flaw is in LiteLLM, an open-source AI gateway used to route requests to many different model providers. CISA's catalog entry, reported by eSecurity Planet on September 2, covers CVE-2026-59822, an authentication weakness in LiteLLM versions before 1.84.0 that lets an unauthenticated attacker establish an authenticated session using an arbitrary bearer token, in some cases a token of a single character. The practical effect is that anyone who can reach a vulnerable LiteLLM instance can connect to the backend models and providers it fronts, which means the stolen credentials of one company could expose the model access of every application behind that gateway.

The second AI-focused flaw sits in a component that few people have heard of but that underlies a large share of the AI stack. CVE-2026-48710 is a request-smuggling vulnerability in Starlette, an asynchronous web framework used by vLLM, LiteLLM and many model-context-protocol servers, and eSecurity Planet reported on September 2 that researchers have observed it chained with the LiteLLM flaw to achieve unauthenticated remote code execution. Because Starlette is a dependency rather than a standalone product, its compromise is harder to track, and organizations may not realize they are exposed until they audit the frameworks underneath their AI applications.

The remaining additions span workflow and infrastructure software with severe scores. The catalog includes CVE-2026-49869, an unauthenticated command injection in the Kestra workflow platform with a CVSS score of 10.0, and CVE-2026-82329, an authentication bypass in JFrog Artifactory, a widely used software repository manager, with a CVSS score of 9.8. It also includes two flaws in SonicWall SMA1000 remote access appliances, one with a CVSS score of 10.0, and an SQL injection in Sangoma Switchvox with a score of 9.8, according to the September 2 catalog entries. The mix is notable because it shows attackers are not discriminating between AI infrastructure and conventional enterprise software, they are taking whichever exposed systems offer the fastest path to credentials and code execution.

Analysis

What this really means is that the security industry's AI moment has shifted from theoretical to operational, and the CISA catalog is the most concrete evidence yet that attackers have learned to monetize the AI software supply chain. The conventional wisdom for the past two years has been that AI is a double-edged sword, powerful for both attackers and defenders, but the vulnerabilities in this batch are not exotic failures of machine learning, they are ordinary web application flaws in software that happens to sit in front of AI models. The bigger picture here is that the AI infrastructure layer grew so fast that it skipped the normal security maturation process, and the industry is now paying for that speed with a wave of easily exploitable authentication and injection bugs in the tools that every AI team depends on.

The three AI-infrastructure flaws in a single KEV batch deserve attention because of what they say about attacker priorities. A gateway like LiteLLM is a perfect target, it sits between an organization and every model it uses, which means a single compromise exposes API keys for multiple providers, proxy-issued virtual keys and the configuration of the entire AI deployment. eSecurity Planet reported that attackers who break into these gateways often extract data from the backing databases and deploy XMRig miners, which suggests that even financially motivated criminals have learned that AI infrastructure is where the valuable credentials live. The chaining of the Starlette and LiteLLM flaws into unauthenticated code execution is the more serious scenario, because it means an internet-facing AI application can be fully compromised without any credentials at all.

The federal patch deadlines add urgency and a compliance angle. Under the binding operational directive, civilian agencies must remediate the SonicWall, Sangoma, Artifactory and Kestra flaws by September 5 and the LiteLLM and Starlette flaws by September 16, which forces a rapid triage across government networks. The deadlines are also a signal to the private sector, because organizations that do business with the federal government or that mirror its security expectations will face pressure to patch on the same schedule, and the two-week window for the AI-infrastructure flaws reflects a recognition that patching an open-source gateway like LiteLLM requires coordination across an entire dependency chain rather than a single vendor update.

Why It Matters

For security teams, the batch is a checklist of the systems most likely to be compromised in the coming weeks, and the fact that three of the seven flaws are in AI infrastructure means any organization running an AI gateway or model server should treat this as an urgent patching event rather than routine maintenance. For the AI industry, the catalog additions are a reputational and operational challenge, because they show that the tools marketed as enterprise-ready are carrying the same class of vulnerabilities that plagued earlier software generations, and that attackers are exploiting them at scale. For the federal government, the September 5 and September 16 deadlines test whether the machinery built to respond to conventional vulnerabilities can keep pace with the AI software supply chain, where a single open-source component like Starlette can expose thousands of downstream deployments. And for the broader technology economy, the pattern of reverse shells and cryptocurrency miners reported in these campaigns is a reminder that the most common AI security risk is not an exotic model attack but the mundane reality of internet-exposed software with weak authentication.

Next Up

In the coming weeks, watch for patch adoption rates for the AI-infrastructure flaws, since the September 16 deadline for LiteLLM and Starlette gives organizations time to coordinate upgrades, and the speed of adoption will indicate how mature AI security operations have become. Watch also for whether CISA adds related flaws to the catalog, because a second batch targeting the same layer of the AI stack would confirm that attackers are systematically probing model gateways and orchestration platforms rather than hitting them opportunistically. The most important signal will come from incident disclosures, because if organizations that run LiteLLM or Starlette begin reporting breaches tied to these specific vulnerabilities, the security industry's focus on AI infrastructure will move from catalog entries to full-scale incident response.