Seven more security flaws are on the US government's list of bugs criminals are actively using, and five come with a three-day deadline. CISA added the seven to its Known Exploited Vulnerabilities (KEV) catalog on September 2, 2026, citing evidence of active exploitation. Three products are new to this site's coverage: JFrog Artifactory, a software repository; Kestra, an open-source workflow orchestrator; and Sangoma Switchvox, a business phone system.
What the three share is the worst kind of bug: per the public records, an attacker who has never logged in ends up with admin or root control.
One request to become an Artifactory admin
The JFrog entry, CVE-2026-82329, carries a CVSS score of 9.8, assigned by JFrog itself. The public description is short: Artifactory "contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges". That is all that is on the record; the NVD entry, published August 28, names no affected versions. It is Artifactory's second listing in a week, after a lower-severity path traversal on August 27. CISA points administrators to JFrog's security advisories page for the fix.
A suffix check that lets anyone run code as root
The Kestra flaw, CVE-2026-49869, is the most severe: the GitHub advisory scores it a maximum 10.0. Per the NVD record, Kestra's authentication filter exempted the public configuration endpoint from Basic Auth by checking whether a request path ends with "/configs". Because that is only a suffix match, any API path whose last segment is "configs" skips authentication entirely. An attacker can then create and execute arbitrary workflows, and because Kestra's shell and Python script plugins are enabled by default, the record says this "directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container". Versions 1.0.45 and 1.3.21 fix it, per the project's advisory.
A phone system that takes SQL from strangers
The Sangoma Switchvox bug, CVE-2026-9586, is an unauthenticated SQL injection in Switchvox SMB Edition 8.3 (build 104997). Per the NVD description, the /pa endpoint concatenates an attacker-controlled PhoneIP value from a PolycomIPPhone XML request straight into PostgreSQL queries, so one crafted request runs arbitrary SQL against the backend, "including database operations and remote code execution". It scores 9.3 under CVSS 4.0 and 9.8 under 3.1. The fix is not new: CISA cites Sangoma's release notes for version 8.4.0.2, dated July 14, 2026, and the NVD record dates from July 17. Anyone still on 8.3 has had seven weeks.
Four you may already have dealt with
The other four this site has covered. Two are the SonicWall SMA1000 bugs, CVE-2026-83548 and CVE-2026-83549, for which SonicWall says patching alone is not enough; Rapid7's emergent threat response team assesses the pair can be chained for unauthenticated remote code execution, which SonicWall has not said. The other two, Starlette's CVE-2026-48710 (CVSS 6.5) and LiteLLM's CVE-2026-59822 (CVSS 8.8), are the library bugs behind last week's story on attackers pulling AI proxy keys out of memory.
Patch by September 5, then check for intruders
The catalog does not treat the seven equally. Under Binding Operational Directive 26-04, the JFrog, Kestra, Sangoma and both SonicWall entries carry a September 5 remediation date and a forensic triage flag, meaning agencies must check whether an attacker was already inside before patching. Starlette and LiteLLM get until September 16 and no triage flag.
- JFrog Artifactory: apply the fix on JFrog's security advisories page.
- Kestra: 1.0.45 or 1.3.21 and later.
- Sangoma Switchvox: 8.4.0.2 or later.
- SonicWall SMA1000: 12.4.3-03526 or 12.5.0-02952, then SonicWall's compromise review.
- Starlette 1.0.1 and LiteLLM 1.84.0.
The deadlines bind only US federal civilian agencies, but CISA's alert urges every organization to prioritize the same list. A three-day deadline with a forensic triage flag reads one way: these bugs are taking over exposed servers now, and a late patch may not be the end of the job.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.