On September 2, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added seven vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, marking another reminder that the threat landscape is moving well beyond traditional operating-system vulnerabilities.

The latest additions touch remote-access infrastructure, enterprise telephony, artifact repositories, workflow orchestration, Python web applications and AI infrastructure.

What makes the update particularly interesting is the diversity of the technologies involved.

These aren’t seven vulnerabilities sitting inside one technology stack.

They represent seven different pieces of modern infrastructure that organizations increasingly depend on.

Seven vulnerabilities, seven different attack surfaces

The September 2 additions include:

• CVE-2026-83548 — SonicWall SMA1000 — Server-Side Request Forgery
• CVE-2026-83549 — SonicWall SMA1000 — OS Command Injection
• CVE-2026-9586 — Sangoma Switchvox — SQL Injection
• CVE-2026-82329 — JFrog Artifactory — Improper Authentication
• CVE-2026-49869 — Kestra OSS — OS Command Injection
• CVE-2026-48710 — Kludex Starlette — HTTP Request/Response Smuggling
• CVE-2026-59822 — BerriAI LiteLLM — Improper Authentication

The common denominator is not the technology.

It is known exploitation in the wild.

That distinction is important because the KEV catalog is not simply another vulnerability database. Inclusion means the vulnerability has crossed from a theoretical security weakness into a vulnerability associated with observed exploitation.

SonicWall SMA1000: Two vulnerabilities, one platform

Two of the seven additions affect SonicWall SMA1000, an appliance designed to provide secure remote access.

The vulnerabilities are particularly notable because they represent two different classes of attack.

CVE-2026-83548 is a Server-Side Request Forgery (SSRF) vulnerability.

SSRF vulnerabilities can allow an attacker to make requests from a vulnerable server to resources that the attacker may not be able to access directly.

The second vulnerability, CVE-2026-83549, is an OS command injection flaw.

Command injection moves the impact considerably further. If successfully exploited, an attacker may be able to cause the underlying operating system to execute commands under the application’s security context.

Seeing SSRF and command injection vulnerabilities appear together in a remote-access appliance is significant because these systems occupy an interesting position in enterprise networks: they are designed to sit at the boundary between external users and internal resources.

Sangoma Switchvox: SQL injection returns to the KEV spotlight

CVE-2026-9586 affects Sangoma Switchvox, a business communications and telephony platform.

The vulnerability is classified as SQL injection.

SQL injection remains one of the oldest web application vulnerabilities, but its continued appearance in actively exploited vulnerability lists demonstrates that the vulnerability class has hardly disappeared.

At its core, SQL injection occurs when attacker-controlled input is incorporated into database queries without adequate separation between data and executable SQL.

Depending on the vulnerable functionality and database permissions, exploitation can expose, manipulate or potentially destroy application data.

The interesting part here isn’t that SQL injection is new.

It is that legacy vulnerability classes continue to find new targets in modern enterprise applications.

JFrog Artifactory: When the software supply chain becomes the target

CVE-2026-82329 affects JFrog Artifactory, a platform widely used for storing and distributing software artifacts.

Artifact repositories occupy a particularly important position in modern development environments.

They can contain:

• application packages
• container images
• binaries
• libraries
• build artifacts
• deployment components

The vulnerability is categorized as improper authentication.

That makes the issue particularly interesting from a software-supply-chain perspective.

An attacker doesn’t necessarily need to compromise the final production application directly if they can gain control somewhere earlier in the development and delivery chain.

The security of the artifact repository therefore becomes part of the security of everything that consumes artifacts from it.

Kestra: Workflow automation enters the picture

CVE-2026-49869 affects Kestra OSS, a workflow orchestration platform.

The vulnerability is an OS command injection issue.

Workflow orchestration platforms can interact with numerous systems: databases, APIs, scripts, cloud services and infrastructure components.

That makes command execution vulnerabilities particularly interesting in this class of software.

A vulnerability in a workflow platform isn’t simply about compromising a web application.

The platform may have the ability to trigger actions across an entire workflow.

This is another example of how modern infrastructure has expanded the definition of an application’s attack surface.

Starlette: The framework underneath the application

CVE-2026-48710 affects Kludex Starlette, a Python web framework.

The vulnerability involves HTTP request/response smuggling.

Request smuggling vulnerabilities are fundamentally about disagreement between different components processing an HTTP request.

For example, a frontend proxy and backend application may interpret request boundaries differently.

An attacker can exploit that difference to manipulate how requests are processed across the application stack.

The interesting aspect of this vulnerability is its position in the technology stack.

Starlette isn’t necessarily the business application itself.

It is infrastructure used by applications.

That means a vulnerability in a framework can potentially have a much broader ecosystem impact than its relatively low-level position might suggest.

LiteLLM: AI infrastructure appears in KEV

Perhaps the most interesting addition from a technology trend perspective is CVE-2026-59822, affecting BerriAI LiteLLM.

LiteLLM is used as an AI gateway/proxy layer to interact with multiple large language model providers and models.

The vulnerability is classified as improper authentication.

The significance goes beyond one AI project.

Over the past few years, AI applications have developed their own infrastructure stack:

Application → AI gateway → model provider → tools/APIs → data sources

Security vulnerabilities can therefore exist not only in the model or application but also in the infrastructure connecting those components.

The appearance of LiteLLM in the KEV catalog is another indication that AI infrastructure is becoming part of the mainstream enterprise attack surface.

The bigger picture

Look at the seven vulnerabilities together and a pattern emerges.

They span:

Remote access

Telephony

Software supply chain

Workflow automation

Python application frameworks

AI infrastructure

There is no single technology connecting them.

What connects them is their role in the modern technology ecosystem.

The traditional image of an enterprise attack surface was dominated by endpoints, operating systems, browsers and network devices.

That picture has changed.

Today, the attack surface includes the systems that build software, distribute software, automate processes, connect users, expose APIs and integrate AI models.

And attackers are following that expansion.

From applications to infrastructure

The most interesting story behind this KEV update isn’t simply that seven vulnerabilities were added.

It is where those vulnerabilities live.

A remote-access appliance.

A communications platform.

An artifact repository.

A workflow engine.

A web framework.

An AI gateway.

These are all different layers of the technology stack, yet compromising any one of them can potentially provide an attacker with a valuable position.

That is why the September 2 KEV additions are worth watching.

They illustrate a broader evolution in vulnerability exploitation:

Attackers don’t need to attack the application directly when the infrastructure supporting the application can provide another path in.

The modern attack surface isn’t just getting larger.

It is getting deeper.