CISA Adds Key DevSecOps Tooling and Registry Flaws to Known Exploited Vulnerabilities Catalog

On September 2, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) catalog with several high-impact security flaws impacting software delivery, repository management, and automation tooling. The newly cataloged vulnerabilities include JFrog Artifactory directory path limitations in Docker cache handling (CVE-2026-66384), Kestra open-source orchestration command injection (CVE-2026-49869), and LiteLLM gateway authentication flaws (CVE-2026-59822). Under federal Binding Operational Directive guidelines, organizations must rapidly remediate these flaws to prevent infrastructure compromise. The addition of artifact management and pipeline orchestration flaws to active exploitation tracking marks an urgent priority for DevSecOps and platform engineering teams. Centralized platforms like JFrog Artifactory act as the single source of truth for container images, language dependencies, and release binaries across entire enterprises. Path traversal issues in Docker cache management can expose systems to arbitrary write actions, potentially allowing threat actors to manipulate cached dependencies. Simultaneously, command injection and authentication flaws in workflow orchestrators allow attackers to execute arbitrary pipeline stages and extract sensitive environment variables without valid credentials. This development fits into an ongoing industry trend where attackers bypass perimeter defenses by directly compromising build infrastructure and delivery tooling. Over recent years, organizations have heavily invested in shifting security left by adding static analysis and secret detection to developer workflows. However, threat actors have responded by targeting the underlying continuous integration and delivery mechanisms—including package registries, workflow runners, and automation gateways. As pipeline components gain broader access to cloud environments and production clusters, compromising an orchestrator or artifact cache yields deep lateral movement opportunities across connected enterprise environments. In practice, DevSecOps teams should immediately assess their exposed delivery infrastructure and apply vendor-issued patches across all artifact registries and workflow systems. Engineering organizations running JFrog Artifactory should audit remote repository configurations and restrict cache path permissions. Teams managing CI/CD orchestration must verify that workflow execution endpoints enforce multi-factor authentication, isolate execution runners inside ephemeral, zero-trust network boundaries, and prevent runner environments from accessing long-lived cloud credentials. Long-term pipeline resilience requires treating CI/CD control planes with the same rigorous access controls and runtime monitoring applied to tier-one production services.