Network edge devices and AI tooling keep appearing on CISA's exploited list
September, 2026 (August to October 2026)
CISA's known-exploited-vulnerability additions between August and October included SonicWall SMA1000 appliances (two flaws on September 2), MikroTik RouterOS (three flaws across September 10 and 25), JFrog Artifactory, BerriAI LiteLLM and Kestra (all September 2), and repeated Microsoft SharePoint entries. Under its directive BOD 26-04, US federal agencies must prioritize listed flaws on internet-exposed assets that give full control, and check for prior compromise before patching. On October 14 CISA also listed two chained flaws in the AhsayCBS backup server (CVE-2026-105133 and CVE-2026-105134). Huntress first saw exploitation on October 7 and had seen five organizations targeted by October 8, and Ahsay said on October 12 that its earlier patches did not fully fix them.
Why it matters
The list shows what attackers actually use: remote-access gear, routers, and developer and AI tooling that is often exposed to the internet.
What defenders can take from it
- Use the CISA list to decide what to patch first. It is free and updated continuously.
- Inventory internet-facing appliances, and check for signs of compromise before applying fixes.