[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6RaeuUpOBjagJzE2RdJladt5Wef_8MyLMX2DICGuEuo":3},{"article":4,"iocs":54,"watch_terms":80,"solutions":81,"lesson":179},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"055dd0a8-052e-4338-b40e-693b50a63bbd","CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners","cisa-adds-seven-exploited-flaws-as-attackers-deploy-reverse-shells-and-crypto-mi-bf0dad","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added seven security flaws to its Known Exploited Vulnerabilities (KEV) catalog after they landed in attackers' crosshairs. The vulnerabilities are as follows - CVE-2026-83548 (CVSS score: 10.0) - A server-side request forgery vulnerability in SonicWall SMA 1000 Appliances that could allow a remote unauthenticated","CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation by threat actors. These flaws, affecting products from SonicWall, Sangoma, JFrog, Kludex, Kestra, and Berri LiteLLM, have been used to deploy reverse shells, gain administrative privileges, and install cryptocurrency miners. Notably, some vulnerabilities are chained for more severe impacts, with Qilin ransomware actors linked to one such exploit chain.","CISA adds seven exploited vulnerabilities to KEV catalog, enabling reverse shells and crypto miners.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fcisa-adds-seven-exploited-flaws-as.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhaGEC2JQn3dU5muXzZhp9ouduHJ5hE4vWW4zHDomXp7hJ3hHafGPmMU33aKs7A8dwhvqsMiwh8PNi4GUNzH635enPZT3oPdcZejqkA9vpPYbQTLZaAhzAVAuUFksC4mCNX6SRUzUx1vhSxokKBz9RBGXXOBJshSXfYLIox2OCi2htQdcmyDJDMvWTamC8\u002Fs1600\u002Fcisa.jpg","2026-09-03T05:19:04+00:00","2026-09-03T08:00:07.2757+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"SMA 1000 Appliances","product",{"name":21,"type":22},"SonicWall","vendor",{"name":24,"type":19},"Switchvox",{"name":26,"type":22},"Sangoma",{"name":28,"type":19},"Artifactory",{"name":30,"type":22},"JFrog","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62,65,68,71,74,77],{"type":56,"value":57,"context":58},"cve","CVE-2026-83548","Server-side request forgery in SonicWall SMA 1000 Appliances",{"type":56,"value":60,"context":61},"CVE-2026-83549","Post-authentication OS command injection in SonicWall SMA 1000 Appliances",{"type":56,"value":63,"context":64},"CVE-2026-9586","SQL injection in Sangoma Switchvox",{"type":56,"value":66,"context":67},"CVE-2026-82329","Improper authentication in JFrog Artifactory",{"type":56,"value":69,"context":70},"CVE-2026-48710","HTTP request\u002Fresponse smuggling in Kludex Starlette",{"type":56,"value":72,"context":73},"CVE-2026-49869","OS command injection in Kestra OSS",{"type":56,"value":75,"context":76},"CVE-2026-59822","Improper authentication in Berri LiteLLM's Model Context Protocol (MCP) Streamable HTTP endpoint",{"type":56,"value":78,"context":79},"CVE-2026-42271","Exploited alongside CVE-2026-48710 for RCE in LiteLLM deployments",[21,26,30],{"controls":82,"vendors":169},[83,112,141],{"slug":84,"name":85,"problem":86,"products":87},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":113,"name":114,"problem":115,"products":116},"patch-management","Automated patch management","Known holes get closed in days, not months.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":53,"name":142,"problem":143,"products":144},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[145,153,161],{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":157,"product_name":158,"url":159,"description":160},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":162,"vendor_name":163,"vendor_logo":164,"product_slug":165,"product_name":166,"url":167,"description":168},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[170,175],{"slug":171,"name":30,"logo_path":172,"roles":173},"jfrog","\u002Fvendor-logos\u002Fjfrog.png",[174],"affected",{"slug":176,"name":21,"logo_path":177,"roles":178},"sonicwall","\u002Fvendor-logos\u002Fsonicwall.png",[174],{"slug":180,"title":181,"body":182,"framework_refs":183,"framework_notes":196},"seven-actively-exploited-flaws-added-to-cisa-kev-reverse-shells-and-crypto-miners-in-the-wild","Seven Actively Exploited Flaws Added to CISA KEV: Reverse Shells and Crypto Miners in the Wild","Threat actors are actively exploiting seven newly catalogued vulnerabilities across widely deployed products from SonicWall, Sangoma, JFrog, and others, using them to deploy reverse shells, escalate privileges, and install cryptocurrency miners. The chaining of multiple vulnerabilities — linked in at least one case to Qilin ransomware operators — demonstrates that unpatched systems in internet-facing positions can become entry points for severe, multi-stage attacks. CISA's Known Exploited Vulnerabilities catalog serves as a critical signal that these flaws are being weaponized in the wild, not just theoretically possible. Organizations that lack timely patch cycles or continuous vulnerability scanning are at acute risk of full compromise, data loss, or ransomware deployment.",[184,185,186,187,188,189,190,191,192,193,194,195],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SI-3: Malicious Code Protection","NIST SC-7: Boundary Protection","NIST RA-5: Vulnerability Monitoring and Scanning","CISA KEV Catalog Binding Operational Directive (BOD) 22-01","ITIL 4: Change Enablement (emergency change procedures)","NIST CSF 2.0: DE.CM (Continuous Monitoring)","NIST CSF 2.0: RS.MI (Incident Mitigation)",{}]