CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesdayaddedseven security flaws to its Known Exploited Vulnerabilities (KEV) catalog after they landed in attackers' crosshairs.

The vulnerabilities are as follows -

The development comes after SonicWalldisclosedthat it "investigated a case indicating the active exploitation" of CVE-2026-83548 and CVE-2026-83549. According to reports fromHorizon3.aiandwatchTowr, unknown threat actors have been observed weaponizing CVE-2026-9586 and CVE-2026-82329 to deploy reverse shells and and minted admin tokens for follow-on enumeration of users, groups, credential sets, and federated access topologies.

As for CVE-2026-48710, a report from Horizon3.ai in June 2026revealedthat the vulnerability could be chained alongside another Berri LiteLLM flaw (CVE-2026-42271, CVSS score: 8.7) to bypass authentication and achieve remote code execution against vulnerable LiteLLM deployments.

It's worth noting that CVE-2026-42271 was added to CISA's KEV catalog around the same time. Per Google-owned Wiz, threat actorsassociatedwith the Qilin (aka Agenda) ransomware have been linked to active exploitation of this chain. The cloud security platform said it has also observed exploitation efforts involving CVE-2026-59822 against its honeypots to probe model enumeration endpoints.

The addition of CVE-2026-49869 to the KEV catalog is driven by a Microsoft report last week in which the vulnerability was likely exploited by a threat actor in late June 2026 to establish a reverse shell, conduct Docker container environment discovery, perform defense evasion, deploy a cryptocurrency miner, and facilitate data harvesting.

"The Kestra compromise exposed four impact paths: shell execution through the workflow engine, container-environment exposure through Docker socket access, host resource hijacking through miner deployment, and follow-on collection through workflow task execution," Microsoftsaid.

"The later curl-pipe-shell event encoded collected output and stored it through Kestra's own key-value interface, reducing reliance on standalone file artifacts."

Separately, the Windows maker also revealed that malicious actors are breaking into LiteLLM gateways using CVE-2026-42271 and CVE-2026-48710 to deliver an XMRig miner via an ELF binary, but not before fingerprinting the host and terminating competing mining processes.

The attackers have also been found to abuse previously collected database information to access the LiteLLM-backed PostgreSQL data tier and target LiteLLM tables, including LiteLLM_ProxyModelTable and LiteLLM_VerificationToken, to harvest records related to model configuration, upstream provider key material, provider endpoints, and proxy-issued virtual keys.

Furthermore, the attack chain is characterized by the addition of persistence using "~/.ssh/authorized_keys" modification, command-and-control (C2), and defense-evasion mechanisms.

The attacks, Microsoft and Wiz said, indicate artificial intelligence (AI) infrastructure, such as LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, Marimo, and MCP servers, has become a lucrative target to steal API keys, gain access to backend systems, maintain persistence, engage in blind prompt injections and AI-native post-exploitation, and monetize infected hosts through illicit cryptocurrency mining.

In another campaign documented by Redmond, it's suspected that adversaries are exploiting exposed RAGFlow instances using flaws likeCVE-2026-45312,CVE-2026-28797,CVE-2026-24770,CVE-2025-68700, andCVE-2025-69286to establish persistence and steal large language model (LLM) provider keys and related metadata.

"The observed objectives were consistent. Across the cases, telemetry showed credential collection, durable access mechanisms, and resource monetization, even though the execution path differed by product," Microsoft said. "Defenders should monitor AI workloads according to their control-plane role, not only as isolated applications."

Pursuant to "Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk," Federal Civilian Executive Branch (FCEB) agencies are recommended to apply patches for all the vulnerabilities, barring CVE-2026-48710 and CVE-2026-59822, by September 5, 2026. Agencies have time until September 16, 2026, to address the Starlette and LiteLLM flaws.