CISA Adds Seven Exploited Flaws to KEV as Attackers Target AI Infrastructure with Reverse Shells and Crypto Miners

The U.S. Cybersecurity and Infrastructure Security Agency added seven actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on September 2, marking a shift in the threat environment: three of the seven directly target artificial intelligence infrastructure.

CISA's update follows reports from SonicWall, Horizon3.ai, watchTowr, and Microsoft documenting active exploitation campaigns that deploy reverse shells, mint administrative tokens, and install cryptocurrency miners across AI gateway platforms including LiteLLM, Berri, Kestra, RAGFlow, and related toolchains.

The AI Infrastructure Attack Surface

The September 2 KEV additions reflect what Microsoft calls a "control-plane" vulnerability pattern in AI workloads. CVE-2026-48710 and CVE-2026-42271 form an authentication-bypass chain that allows unauthenticated attackers to achieve remote code execution against LiteLLM deployments—a widely used AI gateway that manages API keys and routes requests to multiple large language model providers.

Horizon3.ai disclosed the CVE-2026-48710 chain in June 2026. By late August, Wiz observed threat actors linked to the Qilin ransomware group actively exploiting the flaw in production environments. The compromise path is direct: attackers bypass authentication, gain RCE, then pivot to the LiteLLM-backed PostgreSQL database to harvest provider API keys, model configurations, and virtual keys stored in the LiteLLM_ProxyModelTable and LiteLLM_VerificationToken tables.

Microsoft's threat intelligence team documented a parallel campaign targeting CVE-2026-49869 in Kestra, an open-source workflow orchestration platform. In late June 2026, attackers exploited the flaw to establish a reverse shell, enumerate the Docker container environment, deploy an XMRig cryptocurrency miner, and exfiltrate workflow data through Kestra's own key-value storage interface. The attack demonstrates what Microsoft describes as four distinct impact paths: shell execution through the workflow engine, container exposure via Docker socket access, resource hijacking through miner deployment, and data harvesting through task execution.

Beyond AI: SonicWall and Broader Exploitation

The remaining KEV additions span a familiar range of enterprise infrastructure. SonicWall confirmed active exploitation of CVE-2026-83548 and CVE-2026-83549 in its own investigation, while CVE-2026-9586 and CVE-2026-82329 have been weaponized to deploy reverse shells and harvest admin tokens for reconnaissance of user accounts, groups, credential sets, and federated access topologies.

CVE-2026-59822 appeared in Wiz honeypot telemetry targeting model enumeration endpoints, suggesting reconnaissance activity against AI inference deployments. Microsoft observed attackers chaining LiteLLM vulnerabilities to deliver XMRig miners, but only after fingerprinting the host and terminating competing mining processes—evidence of resource optimization within the attacker's monetization workflow.

The exploitation campaigns also demonstrate persistence techniques. Microsoft documented attackers modifying ~/.ssh/authorized_keys files, establishing command-and-control channels, and deploying defense-evasion mechanisms to maintain access across AI infrastructure.

RAGFlow and the Expanding AI Attack Chain

In a separate campaign detailed by Microsoft, adversaries are exploiting exposed RAGFlow instances through a cascade of flaws: CVE-2026-45312, CVE-2026-28797, CVE-2026-24770, CVE-2025-68700, and CVE-2025-69286. The objective remains consistent—credential collection, persistence, and resource monetization—but the execution path differs by product.

RAGFlow is a retrieval-augmented generation framework that connects LLMs to external knowledge bases. Exploiting it provides attackers with access to LLM provider keys and metadata about the models and data sources backing AI applications. Microsoft's telemetry shows attackers using RAGFlow compromises to establish durable access mechanisms and steal API credentials that can be monetized or used for follow-on attacks.

The pattern extends beyond LiteLLM and RAGFlow. Microsoft lists Flowise, LangChain, Langflow, ChromaDB, Ollama, Marimo, and MCP servers as active targets in the broader AI infrastructure threat environment. These platforms share a common architectural trait: they sit between user-facing applications and backend LLM APIs, managing authentication, routing, and data transformation. Compromising them provides attackers with access to the upstream provider keys that represent both financial value and control over AI services.

Federal Patch Deadlines Under BOD 26-04

Federal Civilian Executive Branch agencies face tight remediation windows under Binding Operational Directive 26-04. CISA requires patches for five of the seven vulnerabilities by September 5, 2026—three days after the KEV listing. The two AI-focused flaws, CVE-2026-48710 and CVE-2026-59822 affecting Starlette and LiteLLM, have an extended deadline of September 16, 2026.

The directive reflects CISA's shift toward risk-prioritized patching. BOD 26-04 collapsed the median federal remediation window from 21 days to 3 days for actively exploited vulnerabilities, a timeline that assumes agencies can identify affected systems, test patches, and deploy updates within 72 hours of KEV listing. The September 5 deadline for the five non-AI vulnerabilities falls on a Thursday—leaving agencies a single business day to complete remediation after the Wednesday KEV addition.

Microsoft's analysis emphasizes that defenders should monitor AI workloads according to their control-plane role, not as isolated applications. The company's telemetry shows credential collection, persistence establishment, and resource monetization as consistent objectives across LiteLLM, Kestra, and RAGFlow compromises, even when the execution paths differ.

Cryptocurrency Mining as Exploitation Signal

The deployment of XMRig miners across both LiteLLM and Kestra compromises provides a behavioral signal for detection. Microsoft observed attackers fingerprinting hosts and terminating competing mining processes before installing their own, suggesting organized campaigns rather than opportunistic scanning. The miner deployment follows initial access and reconnaissance, indicating that attackers view compromised AI infrastructure as monetizable compute resources.

The cryptocurrency mining activity also exposes a secondary attack path. Once attackers establish initial access through vulnerability exploitation, they deploy miners to generate immediate revenue while simultaneously harvesting API keys and credentials for longer-term exploitation. The dual-use pattern—immediate monetization through mining and future exploitation through stolen credentials—suggests coordinated campaigns with both short-term and strategic objectives.

CISA's KEV lag tracker shows the median exploited vulnerability was publicly known for 262 days before catalog listing, measured across 1,694 CVEs with verified publication dates. The September 2 additions follow a different pattern: CVE-2026-42271 was disclosed in June 2026 and exploited by Qilin ransomware affiliates within weeks, while CVE-2026-49869 was exploited in late June shortly after disclosure. The compressed timeline reflects the growing value of AI infrastructure as an attack target.

What's Next for AI Infrastructure Defense

The three AI-focused vulnerabilities in the September 2 KEV update mark a milestone in threat evolution. AI gateways like LiteLLM, workflow orchestrators like Kestra, and RAG frameworks like RAGFlow weren't designed with adversarial access in mind—they emerged from open-source communities focused on developer productivity rather than security hardening.

Microsoft's guidance to monitor AI workloads by control-plane role reflects this reality. Organizations deploying AI infrastructure need to treat gateway platforms as high-value authentication and authorization boundaries, applying the same security controls used for identity providers, API gateways, and secret management systems.

The federal patch deadlines under BOD 26-04 create a three-day window for most of the September 2 KEV additions, but the underlying challenge extends beyond patching. Organizations using AI infrastructure need visibility into which platforms mediate access to LLM providers, what credentials those platforms store, and how quickly they can isolate or patch compromised systems.

The shift from opportunistic scanning to targeted AI infrastructure exploitation suggests attackers understand the value of LLM API keys and the architectural role of gateway platforms. As AI workloads scale, the attack surface expands beyond the models themselves to the orchestration, routing, and credential management layers that sit between applications and backend providers.

For more on Cybersecurity developments, see our coverage of emerging threats in AI and enterprise infrastructure.

Official Sources and Further Reading

Security teams can monitor the evolving threat environment through official channels. The CISA Known Exploited Vulnerabilities Catalog provides real-time updates on actively exploited flaws requiring federal patching. Microsoft's Security Intelligence blog offers detailed analysis of exploitation patterns targeting AI infrastructure, while the Wiz threat research delivers insights into ransomware tactics and cloud-native attack chains.

These resources help organizations understand not just what vulnerabilities exist, but how attackers chain them together to establish persistence, steal credentials, and monetize compromised systems. By studying these official reports and technical analyses, security teams can build detection rules, prioritize patching efforts, and develop incident response plans tailored to the specific tactics observed in AI infrastructure attacks.

The convergence of AI and cybersecurity creates a unique defensive challenge. Traditional security tools designed for perimeter defense and endpoint protection struggle to monitor AI infrastructure at the gateway layer where model requests flow, tokens are minted, and API keys circulate. Organizations need specialized observability for their AI control planes, tracking authentication patterns, request volumes, and credential access across every LLM-connected application. Without this visibility, attackers exploiting gateway vulnerabilities can operate undetected for weeks, as the September 2 KEV additions demonstrate.