AI-agent software vulnerabilities on CISA KEV: quarterly count (Q3 2026)
Quick answer, Oct 29, 2026As of 29 October 2026, six CVEs in the AI-agent software stack were added to CISA's Known Exploited Vulnerabilities catalog between 1 July 2026 and 30 September 2026. Q4 2026 is partial through 28 October 2026 and has zero additions in the stack so far. The catalog was pulled on 29 October 2026.
Window and method
- Window: CISA KEV additions dated 1 July 2026 through 30 September 2026 (Q3 2026). Q4-to-date through 28 October 2026 is reported as a watch item.
- Source: CISA KEV catalog JSON, known_exploited_vulnerabilities.json, pulled on 29 October 2026 at about 15:00 ET (catalog version 2026.10.28).
- AI-agent filter: a KEV entry is included if the vendor, product, name or short description, after lowercasing and normalising non-alphanumeric runs to spaces, matches a whole-word phrase from the stack definition in
lib/records/ai-stack.jsonin the Distributed Risk source tree. Layers include agent frameworks (LangChain, LangGraph, LlamaIndex, CrewAI, AutoGen, Langflow, Flowise, n8n, Dify, smolagents), LLM gateways (LiteLLM), MCP servers and clients, model serving (vLLM, Ollama, SGLang, llama.cpp), ML platforms (MLflow, Ray, Jupyter) and AI apps.
Count
| Quarter | AI-agent KEV additions | Note |
|---|---|---|
| Q1 2026 | 2 | n8n, Langflow |
| Q2 2026 | 3 | LiteLLM (×2), Langflow |
| Q3 2026 | 6 | Langflow (×3), LiteLLM, Ray, MLflow |
| Q4 2026 (through 28 Oct 2026) | 0 | Partial quarter; next cut 1 January 2027 |
Q3 2026 additions
| CVE | Vendor / product | Added | Layer | KEV entry |
|---|---|---|---|---|
| CVE-2026-59822 | BerriAI / LiteLLM | 2 Sep 2026 | LLM gateway | Improper Authentication |
| CVE-2026-64849 | MLflow / MLflow | 19 Aug 2026 | ML platform | Server-Side Request Forgery |
| CVE-2025-62593 | Ray-Project / Ray | 17 Aug 2026 | ML platform | Code Injection |
| CVE-2026-9198 | IBM / Langflow | 4 Aug 2026 | Agent framework | Code Injection |
| CVE-2026-0770 | Langflow / Langflow | 21 Jul 2026 | Agent framework | Inclusion of Functionality from Untrusted Control Sphere |
| CVE-2026-55255 | Langflow / Langflow | 7 Jul 2026 | Agent framework | Authorization Bypass Through User-Controlled Key |
The catalog is on CISA's KEV page; each CVE record is on CVE.org and the National Vulnerability Database. Where CISA records known ransomware use, the catalog says so in the entry; none of the six above is marked that way at the time of the pull.
What the count does and does not say
- A KEV listing is CISA's finding of evidence of exploitation, with a required action and, for federal civilian agencies, a due date. See KEV vs EPSS for how to read KEV with FIRST's EPSS estimate.
- The filter matches vendor, product and short description words. A KEV entry whose description does not name an AI-stack phrase but is used by an AI pipeline (for example, a general Python runtime) will not match. That is a known limit of a phrase-based filter; see the stack definition on GitHub.
- Zero additions in Q4-to-date is a point-in-time read on 28 October 2026. The next CISA update may change it.
Live, in an AI assistant
search_kev on the Distributed Risk MCP server returns the same catalog with an ai_stack filter, newest first. list_ai_stack_vulnerabilities adds OSV.dev advisories and malicious-package reports against the same stack, so a reader can see KEV and the open-source advisory record together. Both tools are read-only and need no key.
Each AI-stack KEV addition that matters gets a dated desk note, with the official record, what it supports for the reader it is written for (a cyber underwriter, a platform owner), what would change the call, and numbered sources.
Questions
How is "AI-agent stack" defined? By the phrase list in lib/records/ai-stack.json in the Distributed Risk source tree, which the desk maintains and versions. The current version is 2026-10-23.
Does the count include EPSS? No. KEV additions are listed by CISA with evidence of exploitation. EPSS, from FIRST, is a model estimate for everything not listed. The MCP tools return both.
When is the next cut? 1 January 2027, covering Q4 2026 (1 October – 31 December 2026).