CISA Adds 7 Exploited CVEs: AI Gateways, VoIP Servers and Workflow Engines Under Active Attack — Your Action Plan

Seven new entries landed on CISA’s Known Exploited Vulnerabilities (KEV) catalog on September 2, 2026 — and buried inside that batch is a story that should alarm every CTO, CISO, and DevOps lead running AI tooling in their stack. Attackers have moved beyond traditional perimeter devices. They are now inside your AI gateways, your workflow orchestrators, and your VoIP systems — and they are deploying reverse shells, cryptocurrency miners, and ransomware before most patching cycles can even begin.

Why AI Infrastructure Is the Hottest New Attack Surface

Two years ago, “AI security” meant protecting models from adversarial inputs. Today it means protecting the infrastructure that serves those models. LiteLLM — a popular open-source AI proxy gateway used by thousands of organisations to route requests across OpenAI, Anthropic, Azure, and other LLM providers — has accumulated multiple severe vulnerabilities in 2026. The latest CISA KEV batch now formally acknowledges what threat actors already knew: AI middleware is in active production, poorly patched, and exceptionally lucrative to compromise.

Similarly, Kestra, an open-source workflow orchestration engine with tens of thousands of weekly downloads, has become a de-facto orchestration layer for data pipelines and automated DevOps workflows. When you can create and execute arbitrary workflows without credentials, you effectively have root on the container running your business automation — and attackers know exactly what to do with that access.

CVE-2026-49869: How a Single Suffix Check Gave Attackers Root in Kestra

The Kestra vulnerability is a textbook authentication filter failure. Prior to versions 1.0.45 and 1.3.21, Kestra’s AuthenticationFilter uses a request.getPath().endsWith("/configs") check to whitelist the public configuration endpoint from Basic Auth. The flaw: endsWith performs suffix matching, not exact matching.

An attacker can craft a request to any API path whose last segment is configs — for example, /api/v1/executions/../workflows/configs — and bypass authentication entirely. Once inside, Kestra ships with script execution plugins enabled by default (plugin-script-shell, plugin-script-python), meaning authentication bypass directly translates to root-level code execution inside the Kestra worker container.

According to a Microsoft threat intelligence report, this vulnerability was exploited as early as late June 2026, with attackers establishing reverse shells, conducting Docker container environment discovery, performing defense evasion, and deploying cryptocurrency miners. CISA added CVE-2026-49869 to KEV on September 2, 2026.

CVE	Product	CVSS	Attack Type	Fixed Version
CVE-2026-49869	Kestra OSS	10.0	Auth bypass → RCE as root	1.0.45 / 1.3.21
CVE-2026-59822	BerriAI LiteLLM	8.8	MCP auth bypass via OAuth2 fallback	1.84.0
CVE-2026-48710	Kludex Starlette	6.5	Host-Header injection → auth bypass	Latest patched release
CVE-2026-9586	Sangoma Switchvox SMB Ed.	9.3	Unauthenticated SQLi → RCE	8.4.0.2

CVE-2026-59822 and the Qilin Ransomware Chain: When Your AI Gateway Becomes a Ransomware Entry Point

LiteLLM’s Model Context Protocol (MCP) Streamable HTTP endpoint supports OAuth2 passthrough for upstream MCP servers. The problem: when LiteLLM key validation fails, the server’s fallback path creates an empty UserAPIKeyAuth() object with no restrictions. Any Bearer token — including a single character — successfully establishes an authenticated MCP session.

Chained with the earlier CVE-2026-42271 (unauthenticated RCE in LiteLLM’s AI gateway, disclosed June 2026) and the CVE-2026-48710 Starlette Host-Header bypass, threat actors affiliated with the Qilin (Agenda) ransomware group can achieve pre-authentication remote code execution against any internet-exposed LiteLLM deployment. The combined attack path carries an effective CVSS 10.0 — no login required, no API key, no prior knowledge of the environment.

For Indian enterprises that have moved to centralised AI gateway architectures — routing GPT-4, Claude, and Gemini calls through a single LiteLLM proxy — this means your AI infrastructure is a direct ransomware entry point if left unpatched. The vulnerability affects all LiteLLM versions before 1.84.0.

For the broader AI security context, see my earlier coverage of AI workflow server attacks — this pattern of targeting orchestration layers is becoming a defining threat of 2026.

CVE-2026-9586: Your VoIP Switchvox Is a Reverse Shell Factory

Sangoma Switchvox SMB Edition 8.3 contains an unauthenticated SQL injection flaw discovered independently by Horizon3 researchers and Security Risk Advisors in April 2026. An attacker sends a specially crafted HTTP POST to an endpoint that requires no authentication, executes arbitrary SQL statements against the backend PostgreSQL database, and escalates that access to operating system command execution.

Exploitation via honeypots was first observed on August 30, 2026. Attackers drop reverse shells and immediately run process enumeration commands — standard early-stage reconnaissance consistent with ransomware affiliate playbooks. The patch — version 8.4.0.2 — was released on July 14, 2026, meaning there was a 47-day window between patch availability and exploitation beginning. The flaw carries a CVSS score of 9.3.

Switchvox is widely deployed across SMBs and mid-market enterprises across India and Southeast Asia. If your organisation runs Switchvox on-premise without network segmentation, your PBX is now a viable lateral movement foothold for attackers.

What You Should Do: Sanjay Seth’s Defensive Checklist

With 30 years in cybersecurity and direct experience deploying zero-trust architectures for enterprises across the Delhi NCR region and beyond, here is my immediate action plan for each of these vulnerabilities:

For Kestra (CVE-2026-49869):

• Patch to Kestra 1.0.45 or 1.3.21 immediately — no exceptions.
• Kestra should never be internet-facing. Place it behind an API gateway with IP allowlisting and enforce mutual TLS for worker communications.
• Audit all containers running the Kestra worker for signs of compromise: unexpected outbound connections, new cron jobs, suspicious processes, cryptocurrency miner binaries (check xmrig, lolminer, etc.).
• Disable unused script execution plugins in kestra.yml — if your workflows don’t use shell scripts, there is no reason to have plugin-script-shell enabled.

For LiteLLM (CVE-2026-59822 + chain):

• Upgrade to LiteLLM 1.84.0 or later. Pin this in your requirements.txt or Docker image tag.
• Never expose LiteLLM’s MCP endpoint directly to the internet. Require authenticated reverse proxy access (e.g., via FortiGate or an NGINX proxy with client certificate auth).
• Review MCP tool permissions — apply the principle of least privilege to each configured MCP integration. An attacker who gains MCP access gains access to every tool configured: databases, code execution sandboxes, calendars, SaaS APIs.
• Enable LiteLLM’s built-in rate limiting and IP allowlisting for the /mcp path specifically.
• Also patch Starlette to its latest release to address CVE-2026-48710 independently.

For Sangoma Switchvox (CVE-2026-9586):

• Upgrade to Switchvox 8.4.0.2 without delay — the patch has been available since July 14.
• Segment your PBX network from your corporate LAN. VoIP systems should sit in a dedicated VLAN with strict firewall rules — see my broader network segmentation guidance for reference.
• Restrict access to the Switchvox admin interface to a management VLAN only. The vulnerable endpoint requires no authentication — if it is reachable, it is exploitable.
• Review Switchvox system logs for unexpected HTTP POST requests to administrative endpoints, unfamiliar outbound connections, and new scheduled tasks.

Universal zero-trust recommendation: These three separate exploitation campaigns share a common thread — attackers are targeting management and orchestration planes that organisations assume are internal. Under a proper zero-trust architecture, no management interface, workflow engine, or AI gateway is implicitly trusted regardless of network location. Every request must be authenticated, authorised, and logged.

Frequently Asked Questions

Are Kestra Cloud and managed Kestra deployments also affected by CVE-2026-49869?

CVE-2026-49869 affects the self-hosted Kestra OSS software prior to versions 1.0.45 and 1.3.21. Kestra’s managed cloud offering is operated by the vendor and was patched independently. However, if your organisation runs a self-managed Kestra instance — including Docker Compose or Kubernetes deployments — you are directly affected and must patch immediately.

How do I confirm my LiteLLM version and whether MCP is enabled?

Run pip show litellm in your deployment environment. If the version is below 1.84.0, update immediately with pip install --upgrade litellm. To check if the MCP endpoint is exposed, look for /mcp routes in your reverse proxy or load balancer configuration and verify that external access is restricted. If you are unsure, assume MCP is exposed and treat it as a high-priority risk.

Is Switchvox Cloud affected by CVE-2026-9586?

According to Sangoma’s advisory, CVE-2026-9586 specifically affects Switchvox SMB Edition 8.3 (on-premise deployments). Sangoma’s cloud-hosted solutions operate on separate infrastructure and were addressed by Sangoma directly. If you run an on-premise Switchvox appliance on version 8.3, you are at risk and should apply the vendor patch without delay.

Why are Indian enterprises particularly at risk from these vulnerabilities?

India’s enterprise IT landscape has a characteristically fast AI adoption curve — many organisations have stood up LiteLLM or similar AI proxy solutions in the past twelve months — often without equivalent investment in securing those deployments. Similarly, Switchvox remains a popular cost-effective VoIP choice across Indian SMBs and mid-market firms. Fast adoption without equally fast security hardening creates exactly the exposure these threat actors are targeting.

Patch Now, Assess Your Exposure, Stay Ahead

The seven vulnerabilities CISA added to KEV on September 2, 2026 are not theoretical risks — they are confirmed, actively-exploited flaws with a deadline for federal agencies of September 22, 2026. If your infrastructure includes Kestra workflows, LiteLLM AI gateways, or Sangoma Switchvox PBX appliances, those systems need to be patched today.

The broader lesson is one I have been repeating to enterprise clients across Delhi NCR, Mumbai, and Bengaluru for years: every new platform your team deploys is an attack surface that needs a security review before it reaches production. AI tooling, workflow orchestration, and modern VoIP are no exceptions to that rule.

For a deeper technical review of your AI infrastructure security posture, your network segmentation strategy, or your organisation’s patch management programme, book a security assessment with me directly. I work with IT leaders across India to identify precisely these kinds of exposure before attackers do.