CISA KEV Catalog Now Lists AI Agent Tools Beside NetScaler Zero-Days

Over the past few months, the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog has started listing more than VPNs, firewalls, and load balancers. AI agent platforms, LLM proxies, and workflow engines now appear next to perimeter appliances on the list of flaws federal agencies must patch. During the same period, Citrix NetScaler has been hit by a run of zero-days, including one exploited against appliances that had been patched only days earlier.

The first AI agent platform lands on the list

Langflow, an AI agent orchestration platform, was the first of its kind added to KEV. CISA listed it with an Adobe ColdFusion flaw and two Joomla page-builder bugs, and federal civilian agencies were given a July 10 deadline under Binding Operational Directive 26-04.1 Three of the four flaws in that batch scored a maximum CVSS 10.0. The Langflow bug had a lower official rating, but that rating understated the risk. Cloud security firm Sysdig documented a June credential-theft campaign in which an operator chained a Langflow insecure direct object reference (IDOR) flaw with a remote code execution bug to steal API and AWS keys across tenant boundaries.1

The CVSS score made the Langflow flaw look less urgent than it was. In AI orchestration tools, a bug that looks like a modest access-control problem can expose the credentials the platform holds for everything it connects to.

September: the AI control plane meets the network edge

The trend became clearer on September 3, when CISA added seven exploited flaws in one batch.2 They fell into two groups:

• Enterprise edge and infrastructure: SonicWall SMA 1000 remote-access appliances, Sangoma Switchvox phone systems, and JFrog Artifactory.2
• AI toolchain: Kestra, Berri LiteLLM, and Kludex Starlette.2

The exploitation details are concrete. Microsoft tied the maximum-severity Kestra flaw to a late-June intrusion in which attackers opened a reverse shell, mapped the Docker environment, and installed a cryptocurrency miner.2 Wiz linked the Qilin ransomware group, also tracked as Agenda, to a LiteLLM exploit chain that pulls upstream model-provider keys directly from the proxy's PostgreSQL tables.2

The LiteLLM and Langflow cases follow the same pattern. Attackers are going after the secrets these tools store. An LLM gateway or agent orchestrator usually holds cloud credentials and model API keys for many downstream services, so compromising it can give access to all of them.

BOD 26-04 raises the stakes

BOD 26-04 governs these deadlines. Aviatrix's write-up of a September 22 batch of four flaws in Check Point, Arista VeloCloud, and F5 BIG-IP systems says the directive requires agencies to prioritize fast remediation of KEV-listed bugs on internet-facing assets. It also adds a requirement to assess for compromise before patching.3

The compromise-assessment requirement may be the most significant part. Sources 1 and 2 show that by the time a flaw reaches KEV, keys may already have been stolen or miners already installed. Patching closes the hole but does not undo an intrusion that already happened.

NetScaler's repeat problem

Citrix has been dealing with its own problems. CISA's advisory feed shows a late-September alert on critical zero-days exploited in NetScaler ADC and Gateway, along with a steady series of small KEV additions through early October.5 SecurityWeek reported that after customers were warned about two exploited zero-days, CVE-2026-88771 and CVE-2026-88772, which led some to take appliances offline, a third flaw appeared: CVE-2026-88779.4 It is a high-severity memory overflow affecting NetScaler ADC and Gateway instances configured as a SAML service provider or identity provider. Reddit users reported attacks against appliances already running the latest version.4 Citrix describes it as a denial-of-service bug, but there are signs it could also allow remote code execution.4

Reading the pattern

The sources agree that AI infrastructure now sits in the same risk category as edge appliances. They differ on emphasis. Source 1 presents Langflow as a historic first. Source 2 sees the September batch as a map of the "AI control plane." Source 3 focuses on the regulatory changes in BOD 26-04.

In my reading, the more important change is one of category rather than any single CVE. Organizations have treated AI workflow tools as developer conveniences, often deployed outside the patching and exposure-management processes used for VPNs. Attackers have noticed that these tools hold valuable credentials and are often exposed to the internet. The NetScaler episode shows that even well-patched, well-known edge gear can be exploited faster than vendors can fix it. AI tooling is newer, less hardened, and often deployed casually, so it is unlikely to fare better.

The practical response is to inventory AI orchestrators and LLM proxies alongside perimeter devices, rotate any keys they store, and follow BOD 26-04's approach of checking for compromise before applying a patch.