CISA Adds Critical AI and VPN Vulnerabilities to KEV Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has recently expanded its Known Exploited Vulnerabilities (KEV) catalog by adding seven actively exploited vulnerabilities, which include significant flaws impacting both AI workflow engines and VPN appliances. This update was published on September 3, 2026, highlighting the evolving threat landscape where traditional IT vulnerabilities are joined by new risks associated with artificial intelligence technologies. The inclusion of these vulnerabilities calls attention to the urgent need for federal agencies to bolster their defensive measures against sophisticated cyber-attacks targeting these technologies.

Among the newly listed vulnerabilities are critical flaws such as CVE-2026-49869, identified within Kestra, an open-source workflow orchestration engine. This vulnerability, rated with a maximum severity of 10.0, allows for unauthenticated command injection, providing attackers a foothold into sensitive systems. The attack exploits a weakness in the AI workflow that enables unauthorized execution of commands, leading to potential data breaches and unauthorized operations, including cryptocurrency mining activities facilitated by compromised Docker environments.

Additionally, vulnerabilities affecting SonicWall’s SMA 1000 remote-access appliances and Sangoma’s Switchvox phone systems, have also made it to the KEV catalog. The CVE-2026-83548 and CVE-2026-83549 vulnerabilities demonstrate the continued exploitation of edge networking devices that are crucial for secure remote access in government operations. This additionally amplifies the risks posed to organizational integrity if these devices are left unpatched.

CISA mandated federal compliance through Binding Operational Directive (BOD) 26-04, compelling agencies to address these vulnerabilities in a timely manner. According to this directive, agencies had a deadline of September 5, 2026, to mitigate five of the listed vulnerabilities, while others, particularly those related to AI, required immediate attention with a looming deadline of September 16, 2026. The federal government’s heightened focus on these vulnerabilities indicates a strategic pivot towards securing the rapidly evolving AI operational environments, which are increasingly seen as prime targets for cybercriminals.

This update reflects the growing acknowledgment among cybersecurity professionals that securing AI applications extends beyond merely patching software; it necessitates a fundamental reevaluation of how AI workloads are monitored and managed. Microsoft security researchers have noted the importance of shifting the narrative, stating that AI security should be viewed through the lens of infrastructure exposure rather than just safety concerns surrounding models. This necessitates a comprehensive approach to AI security, urging organizations to rethink their cybersecurity protocols and defenses.

As federal agencies expedite their responses to these vulnerabilities, there are significant procurement implications for vendors and service providers within the cybersecurity sector. Organizations will need to prioritize obtaining security solutions that specifically address vulnerabilities in AI infrastructure and the associated security shortfalls in VPN technologies.

Key Insights:

• Federal procurement professionals must focus on acquiring enhanced security solutions targeted at AI and VPN vulnerabilities.
• All agency contracts should incorporate provisions for timely patch management in compliance with BOD 26-04.
• Organizations providing cybersecurity support should align their services with these emerging threats, especially in AI workload monitoring and VPN security.
• The update signals a growing market for vendors skilled in AI infrastructure protection and cybersecurity.
• Professional services that can implement swift compliance measures around the BOD and vulnerability patching may gain a competitive edge in future contracts.