Seven exploited flaws. Four in systems your SOC doesn't watch.

On September 2, 2026, CISA added seven vulnerabilities to the Known Exploited Vulnerabilities catalog. That is a routine sentence. The catalog gets additions most weeks, and a security team's normal response is to grep an asset inventory for the affected products and move on.

Read the list of products, though, and something has changed:

A remote access appliance. A phone system. And then: a model gateway, an artifact repository, a workflow orchestrator, and a Python web framework.

Four of the seven are in the software factory, not the network perimeter. They are systems your SOC almost certainly does not monitor, owned by teams that do not report to security, running in a part of the estate where "unusual behavior" has never had a definition.

What is actually on the list

CVE-2026-59822 — BerriAI LiteLLM, CVSS 8.8. An improper-authentication flaw in the Model Context Protocol streamable HTTP endpoint. An unauthenticated attacker can establish an authenticated session using an arbitrary Bearer token. The gateway that fronts your model traffic will accept a token you made up.

CVE-2026-82329 — JFrog Artifactory, CVSS 9.8. Improper authentication which, in default configuration, lets an unauthenticated attacker with network access obtain administrative privileges. Threat actors have been observed minting admin tokens and using them to enumerate users, groups, credential sets and federated access topology — mapping the trust graph from inside the thing that stores every build artifact you ship.

CVE-2026-49869 — Kestra OSS, CVSS 10.0. OS command injection allowing an unauthenticated remote attacker to create and execute workflows with no credentials at all. Microsoft documented exploitation from late June 2026: a reverse shell, Docker environment discovery, a cryptocurrency miner, and data collection whose output was encoded and stored through Kestra's own key-value interface.

CVE-2026-48710 — Kludex Starlette, CVSS 6.5. HTTP request/response smuggling via URL path reconstruction, used to bypass authentication, and chained with CVE-2026-42271 to reach remote code execution. Qilin ransomware operators have been observed exploiting that chain.

Rounding out the batch: CVE-2026-9586 in Sangoma Switchvox (CVSS 9.3, SQL injection, weaponized for reverse shells per Horizon3.ai) and the two SonicWall SMA1000 flaws being chained for unauthenticated code execution on the network edge.

The exploited-in-the-wild list is a map of where attackers are actually working. It just moved into the build pipeline, and the build pipeline has no SOC.

The pattern is not "AI is insecure"

It would be easy and wrong to read this batch as a story about model infrastructure being immature. Look at what the four flaws have in common and the real pattern is sharper than that.

Three of the four are authentication failures — not memory corruption, not injection into a parser, but a service deciding that an unauthenticated stranger is a legitimate, privileged principal. LiteLLM accepts an invented Bearer token. Artifactory hands out admin in its default configuration. Kestra runs a workflow for someone who never logged in.

These are young systems that grew up inside the trust boundary. They were written for a network where everything calling them was already friendly — a CI runner, a service mesh, a developer's laptop on the VPN. Authentication was a formality bolted to the side, because the deployment assumption was that nobody hostile could reach the port. Then the platform got useful, someone exposed it so a partner team could reach it, and the assumption quietly stopped being true.

And what the attacker takes from these systems is not data. It is trust. An admin token in Artifactory is not an intrusion into Artifactory; it is signing authority over everything your organization ships to production. A session on a model gateway is a place to read the prompts and the keys of every application behind it. The compromise happens in the pipeline and lands, weeks later, in the customer's environment — as a legitimately built, correctly signed artifact.

Why the SOC does not see it

Ask a security team what normal looks like on a domain controller and you will get a precise answer. Ask what normal looks like on a workflow orchestrator and the honest answer is that nobody has ever thought about it.

Three things break at once in the software factory:

The telemetry isn't there. Build infrastructure logs to whatever the platform team wired up, usually for debugging failed pipelines rather than for detection. Much of it never reaches the SIEM. What does arrive is unparsed, unenriched, and has no detection content written against it, because detection engineering effort follows the attacks people have already seen — and until now these attacks were not on the list.

The malicious action is the platform's normal function. This is the hard part. A workflow orchestrator's entire purpose is to execute arbitrary commands on a schedule. An artifact repository's entire purpose is to hand out packages to whoever asks. A model gateway's purpose is to accept API calls and forward them. When the attacker's technique is "use the product as designed, with credentials it should never have issued," there is no malicious binary, no anomalous protocol, no signature to write. The Kestra intrusion stored its stolen data in Kestra's own key-value store. That is not evasion. That is just using the tool.

Nobody owns it. The appliance belongs to the network team, the repository to platform engineering, the orchestrator to data engineering, the framework to whichever squad picked it. Security owns the consequences and none of the assets.

Coverage is not a product you buy per system

The instinctive fix is a new tool per surface: something for the pipeline, something for the model stack. That is how the coverage gap was created in the first place — one monitored island per budget cycle, with the water between them untouched.

The premise n0limit is built on is totality: every event, from every system, investigated. Not every event matched against a rule someone remembered to write, and not a sampled subset of the systems someone remembered to onboard. When there is no rule for "Artifactory issued an admin token to an unauthenticated caller," the only thing that catches it is a system that already knows what that repository has done every day for months and treats the deviation as an investigation rather than a log line.

That is a machine-speed problem by construction. A build estate produces orders of magnitude more events than an endpoint fleet, almost all of them benign, and the malicious ones are indistinguishable from the benign ones except in context. Sampling misses it. Human triage cannot reach it. Correlating every event to a verdict in under 500 microseconds is the only shape of answer that fits the problem.

What to do this week

The patching is the easy half, and the deadlines already passed for most of this batch — September 5 for the majority, September 16 for the Starlette and LiteLLM entries. Do it, and then ask the harder question, because several of these were exploited for months before they were catalogued.

Inventory what in your build and model infrastructure is reachable from outside its intended trust boundary — the LiteLLM endpoint someone exposed for a partner integration, the Artifactory instance that answers on a public load balancer, the orchestrator on a flat internal network. Then look at whether a single one of those systems sends telemetry anywhere a human or a machine would notice it behaving strangely.

For most organizations the answer is no. That is not a tooling failure — it is a boundary that moved while the monitoring stayed where it was. Attackers found the new boundary first. They usually do. The catalog is simply where that discovery becomes public.