CVEs added to CISA KEV in September 2026
7 pages are kept for entries CISA added to the Known Exploited Vulnerabilities catalog in September 2026, newest first. Entries marked Archived record are no longer in the catalog and show the data as last seen.
Build snapshot collected · KEV catalog 2026.10.21 · EPSS of 21 Oct 2026 · not a live feed: collected once, at build time
- CVE-2026-9586
Sangoma · Switchvox
Sangoma Switchvox SQL Injection Vulnerability
added 2 Sep 2026 · EPSS 19.0% · last seen 22 Oct 2026
- CVE-2026-82329
JFrog · Artifactory
JFrog Artifactory Improper Authentication Vulnerability
added 2 Sep 2026 · EPSS 14.1% · last seen 22 Oct 2026
- CVE-2026-83549
SonicWall · SMA1000 Appliances
SonicWall SMA1000 Appliances OS Command Injection Vulnerability
added 2 Sep 2026 · EPSS 9.89% · last seen 22 Oct 2026
- CVE-2026-83548
SonicWall · SMA1000 Appliances
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
added 2 Sep 2026 · EPSS 8.04% · last seen 22 Oct 2026
- CVE-2026-48710
Kludex · Starlette
Kludex Starlette HTTP Request/Response Smuggling Vulnerability
added 2 Sep 2026 · EPSS 7.06% · last seen 22 Oct 2026
- CVE-2026-49869
Kestra · Kestra OSS
Kestra OSS OS Command Injection Vulnerability
added 2 Sep 2026 · EPSS 2.10% · last seen 22 Oct 2026
- CVE-2026-59822
BerriAI · LiteLLM
BerriAI LiteLLM Improper Authentication Vulnerability
added 2 Sep 2026 · EPSS 0.84% · last seen 22 Oct 2026
Other months
Questions
How many archived entries were added to KEV in September 2026?
7 entry pages are kept for September 2026. The month is the date CISA added the entry to the Known Exploited Vulnerabilities catalog.
Are archived pages up to date?
An entry that CISA still lists is refreshed on every collection. An entry marked "Archived record" has left the catalog and shows what was published when it was last seen.
Related sections
- WatchlistWhat attackers started using this month, most urgent first.
- Exploited catalogEvery flaw CISA lists as used in real attacks (KEV), searchable.
- CVE lookupType one identifier: attack status, probability, severity, versions.
- Attack probabilityEPSS score for up to 100 identifiers at once.
- VendorsWhich vendors have the most exploited flaws.
- RSS and JSON feedsFollow new exploited flaws for the vendors you run.
- Sources and methodWhere each number comes from and how the order is decided.