AI-agent software vulnerabilities on CISA KEV: Q3 2026
Quick answer, Nov 11, 2026This edition names six CVEs that CISA added to its Known Exploited Vulnerabilities catalog from 7 July to 2 September 2026: three in Langflow and one each in Ray, MLflow and BerriAI LiteLLM. None was marked for known ransomware campaign use when the catalog was read. This edition does not publish a quarterly total for the stack.
Q3 2026 edition. KEV additions dated 1 July to 30 September 2026. Catalog version 2026.10.28, read on 29 October 2026 at about 15:00 ET. This edition is frozen at that read; any correction is added as a dated line. Every edition and the method are on AI-agent software vulnerabilities on CISA KEV: quarterly count.
Revised 11 November 2026: method section added. This edition no longer publishes quarterly totals for the stack (see below).
Q3 2026 entries named in this edition
Six CVEs from the catalog are named here:
- Three of the six were in Langflow: CVE-2026-55255, added 7 July 2026; CVE-2026-0770, added 21 July 2026; and CVE-2026-9198, listed under IBM, added 4 August 2026 (same catalog).
- The other three were CVE-2025-62593 in Ray, added 17 August 2026; CVE-2026-64849 in MLflow, added 19 August 2026; and CVE-2026-59822 in BerriAI LiteLLM, added 2 September 2026 (same catalog).
- None of the six Q3 entries was marked by CISA for known ransomware campaign use when the catalog was read (same catalog, knownRansomwareCampaignUse "Unknown").
| CVE | Vendor / product | Added to KEV |
|---|---|---|
| CVE-2026-55255 | Langflow / Langflow | 7 Jul 2026 |
| CVE-2026-0770 | Langflow / Langflow | 21 Jul 2026 |
| CVE-2026-9198 | IBM / Langflow | 4 Aug 2026 |
| CVE-2025-62593 | Ray-Project / Ray | 17 Aug 2026 |
| CVE-2026-64849 | MLflow / MLflow | 19 Aug 2026 |
| CVE-2026-59822 | BerriAI / LiteLLM | 2 Sep 2026 |
Source: CISA KEV JSON, known_exploited_vulnerabilities.json, version 2026.10.28 read 29 October 2026; entries re-checked against version 2026.11.10 on 11 November 2026. The re-check is not a new figure. The catalog is on CISA's KEV page.
Why there is no quarterly total
This edition does not publish a quarterly count for the AI-agent stack, and does not compare quarters. The full phrase list that defines the stack, lib/records/ai-stack.json, is not publicly readable (HTTP 404, 11 November 2026), so a reader cannot independently reproduce a complete count. The six entries above are named from the catalog. They are not presented as the complete count for the stack.
How this count is made
What was reviewed. CISA's Known Exploited Vulnerabilities (KEV) catalog, read as the JSON feed known_exploited_vulnerabilities.json. Each entry is a CVE that CISA has added because of evidence of exploitation.
Date window. KEV additions dated 1 July to 30 September 2026 (Q3 2026), by the catalog's dateAdded field.
When the catalog was read. 29 October 2026, about 15:00 ET, catalog version 2026.10.28.
How entries are selected. An entry counts when its vendor, product, vulnerability name or short description, after lowercasing and replacing runs of non-alphanumeric characters with spaces, contains a whole-word phrase from the Distributed Risk AI-stack list. The list covers agent frameworks (LangChain, LangGraph, LlamaIndex, CrewAI, AutoGen, Langflow, Flowise, n8n, Dify, smolagents), LLM gateways (LiteLLM), MCP servers and clients, model serving (vLLM, Ollama, SGLang, llama.cpp), ML platforms (MLflow, Ray, Jupyter) and AI apps. The full phrase list and its version are in lib/records/ai-stack.json; that file is not publicly readable (HTTP 404, 11 November 2026), so a reader cannot independently reproduce a complete count.
What counts. Each CVE counts once, in the quarter of its dateAdded. A product with several CVEs added in the quarter counts once per CVE.
Limits.
- The filter matches words. A KEV entry used inside an AI pipeline whose catalog text names no AI-stack phrase (for example, a general Python runtime) does not count.
- A word match can also include an entry outside the stack if the phrase appears in another sense; each match should be read before counting (whether this was done: UNKNOWN).
- KEV lists exploited vulnerabilities only. It is not a count of all vulnerabilities in this software; EPSS, from FIRST, is a model estimate for the rest and is not part of the count. See KEV vs EPSS.
In an AI assistant
Run the same filter in an AI assistant with search_kev on the Distributed Risk MCP server.