CISA Adds Seven Exploited Flaws in One Day. Two Score a Perfect 10, All Sit on Internet-Facing Software.

What happened

CISA's September 2 alert added these seven entries to the KEV catalog:

The two SonicWall bugs chain: the SSRF gives an unauthenticated attacker a path into the appliance's management interface, and the command injection turns an authenticated session into a shell. SonicWall confirmed active exploitation. For Kestra, Microsoft had already documented a late June compromise in which attackers created workflows without credentials, opened a reverse shell, enumerated containers and installed a cryptocurrency miner. The LiteLLM flaw is notable as an early example of Model Context Protocol servers being probed in the wild: honeypots saw attackers establishing sessions with arbitrary bearer tokens and enumerating models.

Why it matters if you run public infrastructure

The list reads like a tour of what mid-sized organizations put on the internet without quite meaning to: a VPN appliance, an artifact repository, a phone system, a workflow engine, an LLM gateway. None of these are "the website." They are the things next to the website, and they tend to be reachable because someone needed remote access once.

The policy angle matters too. CISA's BOD 26-04, in force for federal civilian agencies, replaces "patch everything in the KEV within a fixed window" with a risk test. Four criteria decide the clock: is the asset publicly exposed, is the CVE in the KEV, is exploitation automatable, and does it grant total control post-exploitation. Meet all four and the remediation deadline is three days. The first criterion is the one most organizations cannot answer from their own records. You cannot prioritize by exposure if you do not know what is exposed. CISA encourages private-sector adoption, and the previous directive, BOD 22-01, became a de facto standard within a couple of years.

What to check this week

1. Enumerate every open port on every host under your domains, from outside. Not the firewall rule set; the observed state. Include hosts you discover from certificate transparency logs, because the forgotten appliance usually has a certificate.
2. Match what answers against this list. SonicWall SMA management interfaces, Artifactory (often on 8081 or 8082), Switchvox admin, Kestra UIs (8080 by default), LiteLLM proxies (4000 by default) and anything built on Starlette or FastAPI that reconstructs URLs for authorization decisions.
3. Ask why each management interface is reachable at all. Most of the flaws on this list are unauthenticated. Behind a VPN or an allowlist they are still bugs, but they are not three-day bugs.
4. Check for compromise before you patch. BOD 26-04 requires agencies to do this, and it is good advice for everyone: an appliance exploited in August is not fixed by a September patch.
5. Watch for new listeners going forward. The port that opened during an incident is the one that matters next month.

How Attack Surface Scan covers this

Attack Surface Scan keeps an outside-in inventory of exposed services on the hosts under your verified domains, including hosts it discovers from certificate transparency logs and adds to monitoring automatically. When a port opens, closes or starts presenting a different service, that is a change in the feed with the evidence attached. It does not perform exploitation or authenticated vulnerability scanning; it answers the question BOD 26-04 asks first, which is "is this reachable from the internet," continuously, so that when the next KEV batch lands you can grep your exposure instead of guessing.

Sources

• CISA: CISA Adds Seven Known Exploited Vulnerabilities to Catalog (September 2, 2026)
• CISA: BOD 26-04, Prioritizing Security Updates Based on Risk
• The Hacker News: CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
• Tenable: What is CISA BOD 26-04 and its impact on vulnerability remediation