CISA Flags exploite activement LiteLLM et Check Point Gateways

Two fresh CVEs just landed on CISA’s Known Exploited Vulnerabilities catalog, and both are already being weaponized in the wild. CVE-2026-42271 is a command injection in BerriAI’s LiteLLM—the open-source proxy that sits between your LLM apps and dozens of model providers. CVE-2026-50751 is an improper authentication hole in Check Point Security Gateways, the kind of firewall bug that lets attackers walk right past perimeter defenses.

LiteLLM: The LLM Supply Chain Risk Nobody Talked About

LiteLLM has become a staple in production AI stacks: it normalizes API calls across OpenAI, Anthropic, Google, and a hundred others. A command injection in that proxy means anyone triggering the exploit can run arbitrary commands on the hosting server. For teams running LiteLLM as a centralized gateway, that’s a direct path to exfiltrating API keys, model weights, or customer data. BerriAI maintains the project; if you’re not on the latest patch, you’re an active target.

Check Point’s Authentication Bypass Gives Attackers a Free Pass

CVE-2026-50751 hits Check Point Security Gateways—the appliances many enterprises rely on for VPN and firewall inspection. Improper authentication means an unauthenticated attacker can bypass authentication entirely. That’s not a theoretical vulnerability; CISA confirmed active exploitation. If you manage Check Point gear, treat this as an emergency patch cycle, not a routine update.

BOD 22-01 Puts Federal Teams on a Clock

Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate both CVEs by the specified deadline. CISA’s KEV catalog is a living list, and these two entries will drive scanning tools and compliance checks across government networks. For private sector defenders, the message is the same: prioritize these vulnerabilities because attackers already have working exploits.

Both flaws are specifics—no vague “remote code execution” hand-waving. CVE-2026-42271 lets an attacker inject OS commands through LiteLLM’s API surface. CVE-2026-50751 bypasses authentication on Check Point gateways. Patch now, and verify your logs for any signs of pre-patch compromise.

Source: CISA Adds Two Known Exploited Vulnerabilities to Catalog
Domain: cisa.gov