Field Notes — Week of September 6, 2026
A short, opinionated digest of what actually mattered this week across cloud, security, AI, and automation — and what it means if you run real systems.
Security: seven KEV additions, and a five-day remediation clock
CISA added seven vulnerabilities to the Known Exploited Vulnerabilities catalog on September 2. The headline entries are CVE-2026-83548 (CVSS 10.0), an unauthenticated server-side request forgery in SonicWall SMA 1000 appliances, and CVE-2026-83549 (CVSS 7.8), a post-authentication OS command injection on the same box — SonicWall confirmed it investigated a case indicating active exploitation of both. Alongside them: CVE-2026-82329 (CVSS 9.8), an improper-authentication flaw in JFrog Artifactory that under default configuration hands an unauthenticated network attacker administrative privileges.
Under BOD 26-04, federal agencies had until September 5 to patch five of the seven. watchTowr reported attackers weaponizing the Artifactory flaw to mint admin tokens and enumerate users, groups, credential sets, and federated access topology.
The take: Note what the Artifactory attackers did after they got in — they didn’t grab binaries, they mapped identity. Your artifact repository holds the federation config for every CI system that talks to it, which makes it a reconnaissance goldmine before it’s ever a supply-chain vector. If you run Artifactory at default config, treat this as an identity incident, not a patch ticket: rotate the tokens, then go read what those tokens can reach.
AI: your inference gateway is now internet-facing attack surface
CVE-2026-59822 (CVSS 8.8) is an improper-authentication bug in Berri LiteLLM’s Model Context Protocol Streamable HTTP endpoint — an unauthenticated attacker can establish an authenticated MCP session using an arbitrary Bearer token. Wiz has seen exploitation attempts against its honeypots probing model-enumeration endpoints. Microsoft reported attackers chaining CVE-2026-42271 and CVE-2026-48710 against LiteLLM gateways to drop an XMRig miner, then pivoting into the backing PostgreSQL tier to read LiteLLM_ProxyModelTable and LiteLLM_VerificationToken — upstream provider key material, provider endpoints, and proxy-issued virtual keys. Persistence came via ~/.ssh/authorized_keys. A parallel campaign targets exposed RAGFlow instances for the same prize.
Microsoft’s framing is the useful part: monitor AI workloads according to their control-plane role, not as isolated applications.
The take: An LLM gateway is a credential concentrator. It holds every upstream provider key your organization uses and issues virtual keys downstream, which makes it functionally a secrets broker that most teams stood up in a sprint and never threat-modeled. Ask three questions today: is it reachable from the internet, does its database sit in the same trust zone as the proxy, and can you rotate every upstream provider key in under an hour? If the answer to the last one is no, that’s your actual exposure.
Automation: a CVSS 10.0 in the orchestrator, exploited through the Docker socket
CVE-2026-49869 (CVSS 10.0) in Kestra OSS lets an unauthenticated remote attacker create and execute arbitrary workflows without credentials. Microsoft traced likely exploitation to late June 2026: reverse shell through the workflow engine, Docker container-environment discovery via socket access, defense evasion, a cryptocurrency miner, and data harvesting. Collected output was encoded and stored through Kestra’s own key-value interface rather than as files on disk.
The take: Workflow orchestrators get deployed as internal tooling and inherit internal-tooling security — a container with the Docker socket mounted and no ingress controls, because “it’s behind the VPN.” It isn’t, often enough. And the exfiltration through Kestra’s own KV store is the detail worth internalizing: the attacker used a legitimate platform feature as the staging area, which defeats file-artifact detection entirely. If your detection strategy for build and orchestration systems is EDR on the host, you are watching the wrong layer.
Cloud: AWS ships the boring governance layer for agent fleets
AWS made Agent Registry generally available on September 3 with tagging for registries and records, organization-wide sharing through AWS Resource Access Manager, and infrastructure-as-code provisioning. The same batch brought EC2 R9g and R9gd memory-optimized instances on Graviton5 to GA — AWS claims up to 25% better compute performance and up to 30% faster database performance than Graviton4 — and extended Lambda recursive loop detection to all commercial regions.
The take: Tagging and RAM sharing on a registry is the least exciting announcement of the week and probably the most consequential. It makes agents countable, attributable, and chargeable — the precondition for anyone in finance or security asking a hard question about them. Do the registration work now, while your agent count is still in the dozens.
ZelMor LLC helps organizations and consultancies with cloud architecture, AI enablement, security & IAM, and automation. If any of the above is a live question for your team, start a conversation.