CISA KEV Catalog: AI Tools, VPNs and Open Source Under Attack

The U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog has grown again. The latest additions show that attackers are working across a wide range of software, from AI orchestration tools to community-maintained server software. Defenders should read the update as a warning that no category of software is off the target list.

What was added

One report describes seven actively exploited flaws entering the catalog. The group places AI-related tools such as LiteLLM and Kestra next to SonicWall VPN products, and the entries carry federal patching deadlines 1. LiteLLM is a widely used layer for routing requests to large language models, and Kestra is a workflow orchestration platform. Their presence on a list usually dominated by firewalls and VPN gateways is notable.

CISA's own material describes a wider batch from late September and early October 2026. Beyond zero-days in Citrix NetScaler, that batch added actively exploited bugs in the following open-source projects [2]:

• The Linux kernel, specifically flaws involving TLS and ebtables
• Apache Struts
• ProFTPD
• ISC BIND
• ONLYOFFICE
• Zammad's self-hosted helpdesk software

Several of these carry CVSS scores of 9.8, near the top of the severity scale. They also come with forensic-triage requirements under Binding Operational Directive 26-04 2.

The two accounts emphasize different things, and they do not clearly describe the same set of entries. The seven-flaw count covers AI tooling and SonicWall 1. The CISA material is built around Citrix and a long list of open-source projects 2. These may be overlapping slices of one busy period or separate catalog updates. Either way, the combined picture is the same: exploitation is spread across commercial edge gear, AI infrastructure and open-source staples at once.

Why AI tooling on the list matters

It is significant that LiteLLM and Kestra appear in the catalog at all 1. Tools like these often sit in privileged positions. LLM gateways commonly hold API keys for several model providers. Orchestration platforms frequently hold credentials to databases, cloud accounts and internal services so they can run automated jobs.

A compromise of either kind of tool can give an attacker a ready-made pivot point into the rest of an organization. Many companies adopted AI tooling quickly over the past few years, often outside traditional procurement and security review. These entries suggest attackers have noticed that gap. Security teams that track VPNs and firewalls closely may have far less visibility into a LiteLLM proxy a data science team set up on its own.

The open-source angle

CISA's framing points to attackers routing through widely deployed community and self-hosted software, not only commercial gateways 2. The projects named are not obscure:

• BIND underpins a large share of DNS infrastructure.
• Apache Struts has a long history as a target in enterprise Java applications.
• ProFTPD remains in use on many servers.
• ONLYOFFICE and Zammad are the self-hosted collaboration and support tools organizations often choose to keep data in-house.

Ironically, self-hosting can increase exposure when patching lags. With a vendor-hosted service, the provider pushes fixes. With a self-hosted deployment, the burden falls on the operator, who may not be watching upstream security advisories. CISA also notes that maintainer patch speed and supply-chain risk remain live concerns alongside the Citrix situation 2. That puts weight on volunteer and small-team maintainers, whose response times vary widely.

Deadlines and directives

KEV listings require federal civilian agencies to remediate by set dates 1. The CISA material adds forensic-triage obligations under BOD 26-04 for several entries 2. This signals that agencies are expected to look for signs of prior compromise, not just apply patches. That distinction matters when a flaw has been exploited before disclosure, because patching does not remove an attacker who is already inside.

For private-sector organizations, the catalog is not binding. It is still one of the most practical prioritization tools available, since every entry has confirmed real-world exploitation rather than theoretical risk.

The takeaway

The lesson from this round is breadth. Defenders who concentrate patching effort on a few well-known appliance vendors are covering only part of the attack surface. The KEV additions span:

• Commercial VPNs and gateways
• AI middleware
• The operating system kernel
• Core internet services such as DNS
• Self-hosted business applications

A reasonable response starts with a full inventory of where these components run, including shadow AI deployments and self-hosted tools. Organizations should then patch against the KEV list on a deadline-driven schedule and, for the most severe entries, check for evidence of compromise rather than assuming a patch closed the door.