CISA KEV Catalog Update: AI Tools, VPNs and Open Source Hit

What happened

The U.S. Cybersecurity and Infrastructure Security Agency has added another set of actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The list is unusually broad. One addition covered seven flaws that place AI-oriented tooling, including the LLM gateway LiteLLM and the workflow orchestration platform Kestra, next to SonicWall VPN appliances. Federal agencies face patch deadlines for each entry 1.

A wider look at the same window, late September into early October 2026, shows more than VPNs and AI infrastructure. Alongside widely covered Citrix NetScaler zero-days, CISA catalogued exploited flaws in several open-source projects [2]:

• the Linux kernel, with bugs in its TLS and ebtables components
• Apache Struts
• ProFTPD
• ISC BIND
• ONLYOFFICE
• Zammad's self-hosted helpdesk software

Several of these carry CVSS scores of 9.8. They also trigger forensic-triage requirements under Binding Operational Directive 26-04 2.

The two accounts frame the update differently. One counts seven additions and highlights AI stacks and VPNs 1. The other covers a larger group of entries from the same period and emphasizes community-maintained software 2. These are probably overlapping views of a busy stretch of KEV activity rather than one tidy batch. Readers who track exact counts should check entries against CISA's catalog directly.

Why the mix matters

KEV inclusion is CISA's statement that a flaw is being exploited in the wild, not just theoretically exploitable. That gives the catalog more weight than a raw CVE feed. It also helps explain why defenders outside the federal government use it as a prioritization list.

The notable feature of this update is who sits on it. SonicWall VPNs and Citrix NetScaler fit a familiar pattern of internet-facing edge appliances that attackers have hit repeatedly for years 12. LiteLLM and Kestra represent something newer 1. Both are infrastructure for the tooling organizations have built around generative AI and automated data pipelines.

This category is easy to underestimate. An LLM proxy may hold API keys for several model providers. An orchestration engine may hold credentials for databases, cloud storage and internal services. Teams often deploy these tools quickly and outside traditional IT review. When attackers show they are exploiting such tools, the AI stack becomes part of the perimeter, whether or not security teams have classified it that way.

The open-source angle

The second account argues that attackers are increasingly working through widely deployed community and self-hosted software, not only commercial gateways 2. The list supports that argument. BIND resolves names for a large share of the internet. Struts has a long record of serious exploitation. ProFTPD and Zammad often run on self-managed servers that may not get regular attention. Kernel flaws in networking subsystems can turn a foothold into deeper control 2.

The risk here is less about any single bug than about how fixes reach users. Open-source fixes depend on maintainers shipping patches, distributions packaging them, and operators actually deploying them. Each step can lag. Self-hosted instances of helpdesk or office-suite software are often run by small teams with no formal patch cadence. The concern about supply-chain exposure and maintainer patch speed is a live operational issue, not an abstract one 2.

The BOD 26-04 forensic-triage requirement attached to several entries suggests CISA wants agencies to do more than patch 2. They are also expected to look for signs that systems were already compromised. For flaws exploited before disclosure, patching alone may arrive too late.

Reading the signal

Taken together, the two accounts point to a fairly clear conclusion. The attack surface that matters has spread well past the classic VPN-and-firewall layer. It now includes:

• edge appliances
• open-source infrastructure components
• self-hosted business applications
• the AI tooling many organizations deployed in the past two years

These categories now appear side by side in the same exploitation data 12.

For federal agencies, the deadlines make the to-do list mandatory 1. For everyone else, the practical step is an inventory question. Does the organization know where it runs LiteLLM, Kestra, BIND, Struts, ProFTPD, ONLYOFFICE or Zammad? Does it know which kernel versions sit under its Linux fleet? Organizations that can answer quickly are in a position to patch and triage. Those that cannot are likely learning that their AI experiments and forgotten self-hosted tools carry the same exposure as their VPN concentrators.