US cyber agency confirms active exploitation of bug in AI proxy tool LiteLLM

What’s actually confirmed

America’s Cybersecurity and Infrastructure Security Agency (CISA) has added a vulnerability in LiteLLM, a tool made by BerriAI, to its Known Exploited Vulnerabilities (KEV) catalogue. The listing, dated 2 September 2026, is unambiguous on one point: this isn’t a theoretical weakness sitting in a lab somewhere. CISA only adds a bug to KEV once it has evidence someone is exploiting it in the real world, and that’s the case here. Federal civilian agencies in the US have been given until 16 September 2026 to patch or mitigate it, under a binding operational directive that applies to government networks.

Beyond that, the detail is thin. CISA’s entry names the vendor and product, gives the CVE identifier (CVE-2026-59822), and points to the NVD record for further reading — but the material NerdBite has seen doesn’t describe the specific mechanism of the flaw, whether it allows remote code execution, data theft, or something else, nor does it say who is exploiting it or at what scale. CISA also lists ransomware use as “unknown,” which is its way of saying it hasn’t seen evidence either way, not that ransomware crews are ruled out.

So who is actually at risk

LiteLLM is developer plumbing, not consumer software. It’s an open-source gateway that lets companies route requests to different large language model providers — think OpenAI, Anthropic and others — through a single, unified interface, often deployed inside a business’s own infrastructure. If you’ve never heard of it, that’s normal: you won’t have it installed on a laptop or phone, and there’s no app-store equivalent to check.

The people who do need to care are engineering and security teams at organisations that have deployed LiteLLM as part of their AI stack — likely startups and enterprises building products on top of third-party language models, plus any government body doing the same. For everyone else, this is background noise rather than a personal security event.

What to do about it

CISA’s advice is standard KEV boilerplate: apply mitigations “in accordance with vendor instructions,” which in practice means checking BerriAI’s own advisories and release notes for a fixed version, rather than relying on CISA’s page to explain the bug. US federal agencies face a hard deadline of 16 September 2026; everyone else operates on CISA’s general guidance that KEV entries should be treated as high priority regardless of sector, because active exploitation tends not to stay confined to one target for long.

If your organisation runs LiteLLM, the sensible move is to check for an available patch immediately, review logs for anything unusual, and not wait for a compliance deadline that technically only binds US government systems.

The takeaway

This is a real, currently-exploited flaw in a real piece of software used by AI developers — that part is solid and checkable via CISA’s own listing. What’s missing from the public record right now is the interesting bit: how the attack actually works and how widely it’s being used. Treat the “actively exploited” label as reason for affected teams to patch promptly, not as reason for the rest of us to panic.