AI gateways and developer tooling join the exploited list: CISA's early-September KEV batch

On 2 September 2026 CISA added seven vulnerabilities to its Known Exploited Vulnerabilities catalogue in a single update. The mix is instructive. Alongside a familiar remote access appliance sit an artifact repository, a workflow orchestrator, an LLM API proxy and a web framework used by a large share of Python services. Attackers are following the infrastructure that modern engineering and AI teams depend on.

The seven

The two SonicWall flaws chain into unauthenticated remote code execution on the SMA 1000. The Artifactory issue allows an unauthenticated attacker with network access to obtain administrative privileges. Kestra's flaw permits unauthenticated workflow execution. The LiteLLM vulnerability allows arbitrary Bearer tokens to be exploited for access. Starlette's HTTP smuggling can be used to bypass authentication through path injection.

CISA set remediation deadlines of 5 September for most of the batch and 16 September for the Starlette and LiteLLM issues.

What attackers are doing with them

Reporting on the campaign describes reverse shells deployed through the SonicWall and Kestra exploits, cryptocurrency miners delivered as ELF binaries (XMRig), harvesting of API keys from LiteLLM instances and the PostgreSQL databases behind them, and persistence through modified SSH authorized_keys files.

The economics are straightforward. An LLM proxy holds API keys for commercial model providers, each of which is a prepaid credit line. An artifact repository holds deployment credentials and the ability to poison builds. A workflow orchestrator can execute commands across the environments it automates. Even where the immediate goal is cryptomining, the credential harvest creates options for later sale or for a more serious intrusion.

What this means for AI and platform teams

AI infrastructure has arrived at the stage where it is attacked opportunistically, not just studied. Tools that were deployed quickly by data or engineering teams, often with default authentication and internet exposure, are now in scanner lists. Three questions every organisation should answer this month:

1. Which of these products do we run, and where? Shadow deployments of LiteLLM, Kestra and similar tools are common in experimentation environments that still hold production keys.
2. What credentials do they hold? Provider API keys, database passwords, cloud roles and tokens for internal services should be inventoried, scoped and rotated if exposure is possible.
3. Who can reach them? None of these services should be exposed to the internet without strong authentication, and most should not be exposed at all.

What to do now

• Patch all seven products to vendor-fixed versions and verify the versions in production, not just in the ticket.
• Review authorized_keys files, cron jobs and running processes on hosts that run Kestra, LiteLLM or Artifactory for signs of persistence and mining.
• Rotate API keys stored in LiteLLM and check provider billing for unexpected usage.
• Audit Artifactory for new administrative users, modified permissions and unexpected artefact uploads.
• Add these product families to your asset inventory and vulnerability intelligence feed so that the next advisory does not arrive as a surprise.

Sources

• The Hacker News: CISA adds seven exploited flaws as attackers deploy reverse shells and crypto miners
• CISA: Adds Seven Known Exploited Vulnerabilities to Catalog (2 September 2026)