September 3, 2026 is shaping up to be a significant patch day. CISA has added six critical vulnerabilities to its Known Exploited Vulnerabilities catalog in a single update, and the breadth of affected technologies tells a clear story about where attackers are focusing their energy right now: AI infrastructure, developer toolchains, HTTP middleware layers, and legacy communications platforms. Each of these vulnerabilities carries confirmed evidence of active exploitation in the wild, which means theoretical risk has already become operational reality for some organizations.

Let us walk through what is being targeted and why it matters.

BerriAI LiteLLM (CVE-2026-59822) is an improper authentication vulnerability in one of the most widely deployed open-source AI gateway platforms. LiteLLM sits between applications and large language model APIs, managing routing, rate limiting, and credentials. An authentication bypass here is particularly dangerous because it can expose API keys for commercial LLM providers, allow unauthorized model invocation at organizational expense, and potentially enable prompt injection or data exfiltration through the AI layer. If your organization has deployed LiteLLM — whether self-hosted or in a containerized environment — treat this as a priority-one patch. Audit all API keys and tokens that LiteLLM has access to, rotate them immediately, and review access logs for anomalous model invocation patterns or unexpected external API calls.

Kestra OSS (CVE-2026-49869) carries an OS command injection vulnerability. Kestra is a popular open-source workflow orchestration platform used to automate data pipelines and business processes. Command injection in an orchestration engine is a worst-case scenario: a successful exploit can give an attacker the ability to execute arbitrary operating system commands in the context of the Kestra service, potentially pivoting to underlying infrastructure, cloud credentials, or connected data stores. Organizations running Kestra should isolate the service behind strict network controls, apply the vendor patch immediately, and review workflow definitions and execution logs for unexpected shell commands or outbound connections.

JFrog Artifactory (CVE-2026-82329) presents an improper authentication vulnerability in one of the most critical pieces of software supply chain infrastructure in enterprise environments. Artifactory stores build artifacts, container images, and package dependencies. An authentication bypass here could allow attackers to inject malicious packages into internal repositories, tamper with build artifacts, or exfiltrate proprietary code and binaries. This is a supply chain attack vector with downstream consequences that can be severe and slow to detect. Patch immediately, enforce multi-factor authentication on all Artifactory accounts, and audit recent artifact uploads and permission changes.

Kludex Starlette (CVE-2026-48710) is an HTTP request and response smuggling vulnerability in the Starlette ASGI framework, which underpins many Python web applications and APIs including those built on FastAPI. Request smuggling attacks exploit inconsistencies in how front-end proxies and back-end servers parse HTTP messages, allowing attackers to bypass security controls, poison caches, hijack sessions, or deliver malicious payloads to other users sharing the same connection. Detection is notoriously difficult because the malicious traffic can appear legitimate to individual inspection points. Organizations should update Starlette dependencies across all Python application environments, review reverse proxy configurations for strict HTTP parsing enforcement, and monitor for anomalous session behavior or unexpected request routing.

Sangoma Switchvox (CVE-2026-9586) rounds out the list with a SQL injection vulnerability in a widely deployed business telephony and unified communications platform. SQL injection in a phone system may seem lower stakes, but Switchvox databases contain call records, voicemail data, user credentials, and internal directory information — all valuable for reconnaissance or credential harvesting. Attackers with database access can also potentially escalate to the underlying operating system. Patch Switchvox immediately, restrict administrative interface access to trusted management networks only, and review database logs for unusual query patterns.

Defensive priorities for security teams today:

- Apply vendor patches for all six CVEs immediately; federal agencies are under a mandatory remediation deadline per CISA BOD 22-01, and private sector organizations should treat KEV additions as equivalent urgency.
- Rotate all credentials and API keys associated with LiteLLM and JFrog Artifactory as a precautionary measure regardless of confirmed compromise.
- Audit Kestra workflow execution logs for unexpected system commands and restrict the service account running Kestra to least-privilege permissions.
- Enforce strict HTTP parsing at your reverse proxy or WAF layer to reduce exposure to request smuggling variants beyond the specific Starlette CVE.
- Isolate Sangoma Switchvox administrative interfaces from general network access and enable database activity monitoring if available.
- Search your asset inventory for all instances of these products, including development, staging, and CI/CD environments, which are frequently overlooked during patch cycles.
- Correlate authentication failures, unusual API activity, and unexpected outbound connections in your SIEM against the affected systems over the past 30 days to identify potential prior compromise.

The common thread across today's KEV additions is that attackers are deliberately targeting the connective tissue of modern infrastructure: the platforms that manage AI access, build pipelines, workflow automation, and communications. Hardening these systems is not optional.

This briefing is informational and intended to supplement, not replace, official vendor security advisories and CISA guidance.