The September 2026 KEV Wave: Reading Exposure Across Six Exploited Products

On 2 September 2026, CISA added seven vulnerabilities to its Known Exploited Vulnerabilities catalog in a single update. The batch spans VoIP management, web frameworks, workflow orchestration, AI gateways, artifact repositories and remote access appliances. Measuring the exposed population for each product shows how differently the same signal lands depending on what is deployed.

The batch

The seven additions were:

• CVE-2026-9586, a SQL injection in Sangoma Switchvox, an IP telephony management platform, rated CVSS 9.3
• CVE-2026-48710, an HTTP request or response smuggling flaw in the Starlette ASGI framework
• CVE-2026-49869, an operating system command injection in Kestra, rated 10.0
• CVE-2026-59822, an improper authentication flaw in the BerriAI LiteLLM AI gateway
• CVE-2026-82329, an authentication bypass in JFrog Artifactory, rated CVSS 9.8
• CVE-2026-83548, a pre-authentication server-side request forgery in SonicWall SMA1000, rated 10.0
• CVE-2026-83549, an operating system command injection in the SonicWall SMA1000 management console Five of the seven carried a federal remediation deadline of 5 September, with the remaining two due by 16 September. Reported activity associated with the batch included reverse shells, cryptocurrency mining, API key theft and activity linked to the Qilin ransomware group.

Measuring the exposed populations

ZoomEye observations at collection time give a sense of scale for the products in the batch where a fingerprint is available.
Search Dork: app="JFrog Artifactory" — 17,874 matches at collection time.
Search Dork: app="Proxmox Virtual Environment" — 34,219 matches at collection time.
Search Dork: app="MikroTik RouterOS" — 937,800 matches at collection time.
Search Dork: app="Kestra" — 124 matches at collection time.
The spread is wide, and it is the most useful thing the measurement shows. The same KEV update covers a product with under two hundred internet-facing instances and a product with nearly a million. A single remediation deadline applied to both.

Why the same signal lands differently

A KEV listing means CISA has evidence of active exploitation. It does not say how many systems are exposed, how reachable they are, or what an attacker gains from compromising one. Those factors differ sharply across the batch.
An artifact repository with tens of thousands of visible instances and a default-configuration authentication bypass is a different problem from a workflow orchestrator with a few hundred visible instances. The repository sits between developers and production, so a compromise propagates through build pipelines. The orchestrator typically sits inside a private network, so its internet-facing count understates its reachable population, but the consequence of compromising one instance still extends to the credentials its workflows use.
The pattern repeats across the batch. A VoIP management platform and a remote access appliance are both boundary systems whose compromise affects the networks behind them. A web framework vulnerability reaches every application built on it, so the exposed population is not the framework's own footprint but the footprint of everything that depends on it. An AI gateway holds the API keys for the models it fronts, which makes credential theft the natural outcome of compromise.

Reading the numbers correctly

Three cautions apply to the counts above.
Exposure is not vulnerability. A fingerprinted instance may be patched, may be cloud-hosted and already remediated by the vendor, or may not be reachable in a way that permits the attack. The counts describe observed exposure, not the vulnerable subset.
Different products have different deployment patterns. A count for a product commonly deployed internally will understate its reachable population, while a count for a product commonly deployed at the network edge will be closer to the full picture. Comparing counts across products without accounting for this is misleading.
A count is a point-in-time observation. Instances are patched, reconfigured and decommissioned continuously. The figures describe the state at collection time and will drift.

What the batch supports

The batch supports a specific operational conclusion. When CISA adds seven vulnerabilities in one update, the deadline is uniform but the exposure is not. An organization that treats the batch as a single task will spend equal effort on products it may not run and on products it runs at scale.
The more useful approach is to check the batch against the asset inventory first. For products in the estate, confirm the version, determine reachability, and prioritize by whether the affected component is internet-facing. For products not in the estate, the entry can be closed without further work.
Two entries in the batch deserve attention beyond the version check. The Artifactory vulnerability allows an unauthenticated attacker to obtain administrator rights in a default configuration, and patching does not invalidate tokens an attacker may already have created, because JFrog supports non-expiring access tokens. The Kestra vulnerability was fixed on 3 June 2026 and added to KEV on 2 September, so the relevant question for organizations that ran an affected version is whether the service was reachable during that interval.

Verification indicators

For the batch as a whole, the reported behavior includes reverse shells, cryptocurrency mining and API key theft. Practical checks include reviewing process and network logs for outbound connections that were not configured by the operations team, examining the plugin or extension directories of affected products for unfamiliar entries, and rotating credentials that were reachable from any affected service.

Limitations

These counts come from ZoomEye observations at collection time and describe internet-facing exposure only. They do not establish how many instances are vulnerable, how many were attacked, or how the observed populations overlap with compromised systems. Counts for different products are not directly comparable because deployment patterns differ. Treat the figures as scale indicators, not incident counts.

References

• CISA Known Exploited Vulnerabilities catalog update, 2 September 2026
• Vendor advisories for Sangoma Switchvox, Starlette, Kestra, BerriAI LiteLLM, JFrog Artifactory and SonicWall SMA1000
• Reporting on observed exploitation activity associated with the batch
• ZoomEye search observations, collected 18 September 2026