CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
CISA added seven critical vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVSS 10.0 flaws in SonicWall SMA 1000 and Kestra OSS, indicating active, real-world exploitation by threat actors. Attackers are weaponizing AI infrastructure vulnerabilities (LiteLLM, Kestra, RAGFlow) to deploy reverse shells, cryptocurrency miners, and steal LLM provider API keys and credential material. The Qilin ransomware group and other threat actors are chaining multiple CVEs together to by
Analysis
TL;DR
- CISA added seven critical vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVSS 10.0 flaws in SonicWall SMA 1000 and Kestra OSS, indicating active, real-world exploitation by threat actors.
- Attackers are weaponizing AI infrastructure vulnerabilities (LiteLLM, Kestra, RAGFlow) to deploy reverse shells, cryptocurrency miners, and steal LLM provider API keys and credential material.
- The Qilin ransomware group and other threat actors are chaining multiple CVEs together to bypass authentication, achieve remote code execution, and establish persistent access through SSH key modification and C2 channels.
- Microsoft and Wiz report that AI infrastructure components (LiteLLM, Flowise, LangChain, MCP servers) have become high-value targets for credential harvesting, resource monetization, and AI-native post-exploitation.
- CISA issued Binding Operational Directive 26-04 mandating prioritized security updates, urging defenders to monitor AI workloads based on their control-plane role rather than treating them as isolated applications.
Why It Matters
This represents a significant escalation in the targeting of AI infrastructure, as threat actors recognize that compromising LLM gateways and orchestration tools provides access to valuable API keys, backend databases, and compute resources. For AI practitioners and security teams, this signals that AI-specific components are no longer peripheral concerns but critical attack surfaces requiring the same rigor as traditional infrastructure. The active exploitation of these flaws in the wild makes immediate patching and monitoring a priority, not a theoretical exercise.
Technical Details
- CVE-2026-83548 (CVSS 10.0) and CVE-2026-83549 (CVSS 7.8): SSRF and post-authentication OS command injection in SonicWall SMA 1000 Appliances, actively exploited per SonicWall's own investigation.
- CVE-2026-9586 (CVSS 9.3): SQL injection in Sangoma Switchvox enabling unauthenticated remote attackers to execute arbitrary SQL against PostgreSQL, including remote code execution.
- CVE-2026-82329 (CVSS 9.8): Improper authentication in JFrog Artifactory under default configuration, allowing unauthenticated administrative privilege escalation.
- CVE-2026-48710 (CVSS 6.5): HTTP request smuggling in Kludex Starlette enabling path injection and authentication bypass, chainable with CVE-2026-42271 (CVSS 8.7) for full RCE.
- CVE-2026-49869 (CVSS 10.0): Unauthenticated OS command injection in Kestra OSS, exploited by a threat actor to establish reverse shells, discover Docker environments, deploy XMRig miners, and harvest data via Kestra's key-value interface.
- CVE-2026-59822 (CVSS 8.8): Improper authentication in Berri LiteLLM's MCP Streamable HTTP endpoint, allowing session establishment with arbitrary Bearer tokens; observed in honeypot probing for model enumeration.
- Attack chains involve SSH authorized_keys persistence, C2 channels, defense evasion, PostgreSQL database targeting (LiteLLM_ProxyModelTable, LiteLLM_VerificationToken), and ELF binary delivery for cryptocurrency mining.
Industry Insight
- AI infrastructure security must be treated as a first-class concern; organizations deploying LiteLLM, LangChain, Flowise, or MCP servers should immediately audit for exposed control-plane endpoints and enforce strict network segmentation.
- The convergence of credential theft and resource monetization (crypto mining) suggests threat actors are prioritizing AI systems for both strategic value (API keys, model access) and immediate financial gain, indicating this trend will intensify as AI adoption grows.
- Defenders should adopt a control-plane-centric monitoring strategy rather than treating AI workloads as isolated applications, implementing detection for anomalous workflow execution, unexpected Docker socket access, and unusual PostgreSQL queries against LLM-specific tables.
Disclaimer: The above content is generated by AI and is for reference only.