vulnerability · 1788307200000

CISA Adds Seven Actively Exploited Vulnerabilities to KEV Catalog

CISA added seven vulnerabilities with evidence of active exploitation to its Known Exploited Vulnerabilities catalog, spanning edge, developer, orchestration, and AI-adjacent software.

What happened

CISA added vulnerabilities affecting SonicWall SMA1000, Sangoma Switchvox, JFrog Artifactory, Starlette, Kestra OSS, and BerriAI LiteLLM to the KEV catalog after exploitation evidence was established.

Technical mechanism

The listed vulnerabilities included server-side request forgery, command injection, SQL injection, and authentication weaknesses that could enable code execution, administrative access, data access, or resource abuse depending on the affected product.

Why it matters

The update highlighted the defensive priority of exploitation evidence over headline severity and showed attackers targeting both traditional edge products and newer automation or AI infrastructure.

Impact

Organizations operating affected products faced confirmed exploitation risk. Federal Civilian Executive Branch agencies received remediation deadlines under the KEV program.

Response

CISA directed covered federal agencies to remediate by catalog deadlines, while vendors published patches or mitigation guidance. Defenders were advised to examine systems for compromise before considering patching complete.

Defensive lessons

  • Prioritize vulnerabilities with confirmed exploitation and exposed attack paths
  • Inventory edge appliances, developer platforms, orchestration tools, and AI gateways together
  • Perform compromise assessment before or alongside remediation

Evidence register

  1. CISA — CISA Adds Seven Known Exploited Vulnerabilities to Catalog (verified)