CISA Flags Active Exploits in LiteLLM und Check Point Gateways

Two fresh CVEs just landed on CISA’s Known Exploited Vulnerabilities catalog, and both are already being weaponized in the wild. CVE-2026-42271 is a command injection in BerriAI’s LiteLLM—the open-source proxy that sits between your LLM apps and dozens of model providers. CVE-2026-50751 is an improper authentication hole in Check Point Security Gateways, the kind of firewall bug that lets attackers walk right past perimeter defenses.

LiteLLM: The LLM Supply Chain Risk Nobody Talked About

LiteLLM has become a staple in production AI stacks: it normalizes API calls across OpenAI, Anthropic, Google, and a hundred others. A command injection in that proxy means anyone triggering the exploit can run arbitrary commands on the hosting server. For teams running LiteLLM as a centralized gateway, that’s a direct path to exfiltrating API keys, model weights, or customer data. BerriAI maintains the project; if you’re not on the latest patch, you’re an active target.

Check Point’s Authentication Bypass Gives Attackers a Free Pass

CVE-2026-50751 hits Check Point Security Gateways—the appliances many enterprises rely on for VPN and firewall inspection. Improper authentication means an unauthenticated attacker can bypass authentication entirely. That’s not a theoretical vulnerability; CISA confirmed active exploitation. If you manage Check Point gear, treat this as an emergency patch cycle, not a routine update.

BOD 22-01 Puts Federal Teams on a Clock

Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate both CVEs by the specified deadline. CISA’s KEV catalog is a living list, and these two entries will drive scanning tools and compliance checks across government networks. For private sector defenders, the message is the same: prioritize these vulnerabilities because attackers already have working exploits.

Both flaws are specifics—no vague “remote code execution” hand-waving. CVE-2026-42271 lets an attacker inject OS commands through LiteLLM’s API surface. CVE-2026-50751 bypasses authentication on Check Point gateways. Patch now, and verify your logs for any signs of pre-patch compromise.

Source: CISA Adds Two Known Exploited Vulnerabilities to Catalog
Domain: cisa.gov