CISA Adds CVE-2026-42271 and CVE-2026-50751 to KEV Catalog
- [01] Malicious actors are actively exploiting vulnerabilities in BerriAI and Check Point systems to gain unauthorized access and execute commands.
- [02] Impacted products include BerriAI LiteLLM and Check Point Security Gateway appliances with improper authentication configurations.
- [03] Organizations must apply manufacturer patches immediately and follow CISA KEV remediation timelines to prevent network compromise.
Overview of CISA KEV Catalog Additions
According to CISA, two new vulnerabilities have been added to the Known Exploited Vulnerabilities (KEV) Catalog. The addition of CVE-2026-42271 and CVE-2026-50751 highlights a persistent trend where attackers target both modern AI infrastructure and traditional network security perimeters. Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch agencies are required to remediate these flaws within specific timeframes. However, the private sector is also urged to prioritize these patches, as inclusion in the KEV catalog indicates clear evidence of active exploitation in the wild.
Technical Analysis of CVE-2026-42271: BerriAI LiteLLM
The CVE identified as CVE-2026-42271 involves a command injection vulnerability within BerriAI LiteLLM. LiteLLM is a popular proxy server that allows developers to call multiple LLM APIs using a unified format. Because LiteLLM often sits between user applications and powerful backend models, a command injection flaw here is particularly dangerous.
How to detect CVE-2026-42271 exploit
When attackers leverage this vulnerability, they typically attempt to inject malicious shell commands through unsanitized input fields processed by the LiteLLM proxy. This can lead to full RCE on the hosting server. SOC teams should monitor for unusual outbound connections from AI proxy containers and audit application logs for shell meta-characters. Implementing a BerriAI LiteLLM 2026 command injection fix involves updating the package to the latest version where input sanitization is strictly enforced.
Analysis of CVE-2026-50751: Check Point Security Gateway
CVE-2026-50751 represents a failure in the authentication mechanism of Check Point Security Gateways. As these gateways serve as the primary defensive layer for many corporate networks, an improper authentication flaw allows unauthenticated users to bypass security controls.
The impact of this vulnerability often includes Privilege Escalation and Lateral Movement once the perimeter is breached. In many documented TTP scenarios, actors use such flaws to establish a C2 channel before deploying Ransomware.
Check Point Security Gateway improper authentication mitigation
To defend against this threat, administrators must immediately apply the recommended firmware updates provided by the vendor. Relying on Zero Trust principles can also limit the blast radius if a gateway is compromised. This involves verifying every request regardless of its origin within the network. Furthermore, monitoring for IoC signatures related to unauthorized administrative access attempts on the gateway management interface is vital for early detection.
Strategic Implications for Defenders
The inclusion of these vulnerabilities in the KEV catalog suggests that they are not merely theoretical risks but are actively being used by APT groups or opportunistic cybercriminals. Organizations using SIEM platforms should ingest the updated KEV list to cross-reference against their own EDR and vulnerability scan data.
Defenders should map these vulnerabilities to the MITRE ATT&CK framework to understand the broader attack lifecycle. For instance, the command injection in BerriAI aligns with Initial Access (T1190 - Exploit Public-Facing Application). By understanding the specific CVSS scores and exploitation context, security teams can justify emergency patching windows to stakeholders.
Remediation and Mitigation Steps
- Update Systems Immediately: Priorities should be given to the Check Point Security Gateway due to its role as a perimeter defense mechanism.
- Audit AI Infrastructure: Review all BerriAI LiteLLM deployments and ensure they are not exposed to the public internet without additional layers of authentication.
- Enhanced Logging: Enable verbose logging on security gateways to capture failed and successful authentication attempts that deviate from known patterns.
- Patch Management: Integrate the CISA KEV catalog into automated patch management workflows to ensure rapid response to future additions.
Advertisement