CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners

Summary: CISA added seven security flaws to its Known Exploited Vulnerabilities catalog on Wednesday after reports of active exploitation, including SonicWall's investigation of CVE-2026-83548 and CVE-2026-83549 and weaponization of CVE-2026-9586 and CVE-2026-82329 to deploy reverse shells and mint admin tokens. Microsoft reported that CVE-2026-49869 was likely exploited in late June 2026 to establish a reverse shell, perform Docker container discovery, evade defenses, deploy a cryptocurrency miner, and harvest data, while attackers also used CVE-2026-42271 and CVE-2026-48710 against LiteLLM gateways to deliver an XMRig miner and access PostgreSQL tables including LiteLLM_ProxyModelTable and LiteLLM_VerificationToken.
Key Takeaway: Attackers are no longer just breaking into AI infrastructure - they are fingerprinting hosts, killing competing miners, and pulling provider key material and proxy-issued virtual keys from LiteLLM's own database tables, which means a single exposed gateway can hand over the credentials to every model provider behind it.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-68700 CVE-2025-69286 CVE-2026-24770 CVE-2026-28797 CVE-2026-42271 CVE-2026-45312 CVE-2026-48710 CVE-2026-49869 CVE-2026-59822 CVE-2026-82329 CVE-2026-83548 CVE-2026-83549 CVE-2026-9586
Related: LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE Cyber Risks ·
Sonic Wall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances Cyber Risks ·
CVE-2026-83549: Sonic Wall SMA1000 Appliances OS Command Injection Vulnerability Known Exploited Vulnerabilities · Sep 02, 2026