CISA KEV update flags seven active flaws with documented reverse shell and miner chains

CISA's September 2026 KEV batch records seven flaws with public exploitation evidence. SonicWall confirmed active use of its two SMA 1000 issues; Microsoft traced CVE-2026-49869 to a late-June incident that produced a reverse shell, Docker socket access, defense evasion and a cryptocurrency miner. Horizon3.ai and watchTowr documented weaponization of the Sangoma and JFrog flaws for admin token minting and enumeration. Wiz linked the Starlette-plus-LiteLLM chain to Qilin ransomware operators.

The evidence trail shows consistent chaining patterns rather than isolated zero-days. CVE-2026-48710 was paired with an earlier LiteLLM flaw already in KEV; Kestra's workflow engine supplied both initial execution and later data staging through its own key-value store. Official attribution remains limited to activity descriptions; no state actor claims appear in the cited vendor or researcher reports.

Procurement and configuration data indicate these appliances and frameworks are deployed in managed service and cloud environments where default settings persist. The addition of two SonicWall CVEs within days of vendor disclosure suggests defenders are reacting after initial access has already occurred.

Next indicators will be rapid scanning for the remaining unauthenticated flaws and follow-on KEV entries for related products that share the same code paths.