Seven Critical Vulnerabilities Exploited in Wild: AI Infrastructure Becomes Prime Target
Executive Summary
CISA added seven critical vulnerabilities to its Known Exploited Vulnerabilities catalog in September 2026 after observing active exploitation by threat actors. The vulnerabilities span multiple platforms including SonicWall SMA appliances, Sangoma Switchvox, JFrog Artifactory, and AI infrastructure components like LiteLLM and Kestra. Attackers exploited these flaws to deploy reverse shells, cryptocurrency miners, and conduct unauthorized operations, with campaigns targeting AI infrastructure becoming increasingly prominent as adversaries seek to harvest API keys and monetize compromised systems.
This incident highlights the growing threat landscape targeting AI infrastructure and the critical importance of rapid vulnerability remediation. With AI systems becoming prime targets for credential theft and resource hijacking, organizations must prioritize security updates and implement comprehensive monitoring across their AI workloads to prevent similar exploitation campaigns.
Why This Matters Now
AI infrastructure has emerged as a lucrative target for cybercriminals seeking to steal API keys, deploy cryptocurrency miners, and gain persistent access to backend systems, making immediate patching and enhanced monitoring of AI workloads critical for organizational security.
Attack Path Analysis
Multi-vector threat actors exploited seven critical vulnerabilities in AI infrastructure and network appliances including SonicWall SMA, JFrog Artifactory, and LiteLLM gateways. Attackers gained initial access through SSRF and authentication bypass flaws, escalated privileges to administrative access, moved laterally through compromised AI systems, established persistent C2 channels with reverse shells, exfiltrated API keys and model configurations, and deployed cryptocurrency miners while maintaining persistence for ongoing operations.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers exploited CVE-2026-83548 (SSRF in SonicWall SMA), CVE-2026-82329 (auth bypass in JFrog Artifactory), and CVE-2026-42271/CVE-2026-48710 (LiteLLM authentication bypass chain) to gain unauthorized access to network appliances and AI infrastructure
Related CVEs
CVE-2026-83548
CVSS 10A server-side request forgery vulnerability in SonicWall SMA 1000 Appliances that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.
Affected Products:
SonicWall SMA 1000 Series – < 12.4.2-02544
Exploit Status:
exploited in the wildCVE-2026-83549
CVSS 7.8A post-authentication operating system command injection vulnerability in SonicWall SMA 1000 Appliances that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
Affected Products:
SonicWall SMA 1000 Series – < 12.4.2-02544
Exploit Status:
exploited in the wildCVE-2026-9586
CVSS 9.8An SQL injection vulnerability in Sangoma Switchvox that could allow an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
Affected Products:
Sangoma Switchvox – < 7.6.3.3
Exploit Status:
exploited in the wildCVE-2026-82329
CVSS 9.8An improper authentication vulnerability in JFrog Artifactory that under default configuration could allow an unauthenticated attacker with network access to obtain administrative privileges.
Affected Products:
JFrog Artifactory – < 7.77.8, 7.84.0 - 7.84.14
Exploit Status:
exploited in the wildCVE-2026-48710
CVSS 6.5An HTTP request/response smuggling vulnerability in Kludex Starlette that could allow attackers to inject paths into the host part, prepending the actual path, leading to issues such as authentication bypass when the authentication depends on the reconstructed URL's path.
Affected Products:
Kludex Starlette – < 0.40.0
Exploit Status:
exploited in the wildCVE-2026-49869
CVSS 10An operating system command injection vulnerability in Kestra OSS that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.
Affected Products:
Kestra Kestra OSS – < 0.19.0
Exploit Status:
exploited in the wildCVE-2026-59822
CVSS 8.2An improper authentication vulnerability in Berri LiteLLM's Model Context Protocol (MCP) Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.
Affected Products:
BerriAI LiteLLM – < 1.44.22
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Command and Scripting Interpreter: Unix Shell
Scheduled Task/Job
Valid Accounts
File and Directory Permissions Modification
Unsecured Credentials: Credentials In Files
Exfiltration Over C2 Channel
Resource Hijacking
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Software Engineering Techniques for Bespoke and Custom Software
Control ID: 6.2.4
NYDFS 23 NYCRR 500 – Risk Assessment
Control ID: 500.09
DORA – Identification
Control ID: Article 8
CISA ZTMM 2.0 – Identity Management and Access Control
Control ID: Identity
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
NIST SP 800-53 – Flaw Remediation
Control ID: SI-2
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Critical exposure through AI infrastructure vulnerabilities enabling reverse shells, crypto miners, authentication bypass, and API key theft across LiteLLM, Kestra platforms.
Financial Services
High-risk multi-vector attacks targeting authentication systems, encrypted traffic manipulation, and potential regulatory violations under PCI/NIST compliance frameworks.
Health Care / Life Sciences
Severe HIPAA compliance violations through unencrypted traffic exploitation, lateral movement capabilities, and unauthorized access to sensitive patient data systems.
Computer Software/Engineering
Direct targeting of software development infrastructure including JFrog Artifactory, Kubernetes environments, and cloud-native security fabric vulnerabilities enabling privilege escalation.
Sources
- CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Minershttps://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.htmlVerified
- CISA Adds Seven Known Exploited Vulnerabilities to Cataloghttps://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalogVerified
- When AI Infrastructure Becomes Target: Securing Gateways and Control Pointshttps://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/Verified
- AI Infrastructure Under Attack: Honeypot Analysis Reveals Targeting of LiteLLM and Other Platformshttps://www.wiz.io/blog/ai-infrastructure-honeypotVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would have significantly constrained this multi-vector attack on AI infrastructure by limiting lateral movement between compromised systems and reducing the attackers' ability to establish widespread persistent access across the environment.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While initial compromise may still occur through vulnerable applications, Zero Trust segmentation would likely constrain the attackers' ability to immediately access surrounding infrastructure and AI workloads from the initially compromised appliances.
Control: Zero Trust Segmentation
Mitigation: Administrative token abuse would likely face significant constraints as Zero Trust segmentation limits the scope of elevated privileges, reducing the attackers' ability to gain broad administrative access across multiple AI infrastructure components.
Control: East-West Traffic Security
Mitigation: Lateral movement through Docker environments and database access would likely be significantly constrained by east-west traffic controls, reducing the attackers' ability to pivot freely between AI workloads and supporting infrastructure components.
Control: Multicloud Visibility & Control
Mitigation: Command and control establishment would likely face constraints through comprehensive traffic visibility and control mechanisms, reducing the attackers' ability to maintain persistent communication channels across the distributed AI infrastructure environment.
Control: Egress Security & Policy Enforcement
Mitigation: Data exfiltration attempts would likely be constrained by egress security controls that limit outbound data flows from AI workloads, reducing the attackers' ability to transfer harvested API keys and model configurations to external systems.
While some cryptocurrency mining activity may still occur on initially compromised systems, the overall resource impact would likely be constrained to isolated workload segments rather than spreading across the entire AI infrastructure environment.
Impact at a Glance
Affected Business Functions
- AI/ML Model Operations
- API Gateway Services
- Network Security Infrastructure
- Database Management Systems
Estimated downtime: 7 days
Estimated loss: $2,500,000
AI model configurations, API keys, authentication tokens, database credentials, LLM provider keys, user authentication data, and proprietary AI workflows. Cryptocurrency mining operations consuming computational resources across multiple infrastructure platforms.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation with identity-based policies to prevent lateral movement between AI workloads and limit blast radius of initial compromises
- • Deploy Egress Security & Policy Enforcement to block unauthorized cryptocurrency mining traffic and prevent exfiltration of API keys to external destinations
- • Enable Multicloud Visibility & Control to detect anomalous interactions with AI infrastructure including repeated malformed requests and suspicious automation patterns
- • Utilize Threat Detection & Anomaly Response capabilities to identify covert remote access tools and baseline normal AI workload behavior for deviation detection
- • Apply Inline IPS (Suricata) to inspect traffic for known exploit patterns targeting AI infrastructure vulnerabilities and block malicious payloads before execution
