Open the book before you open the ticket. CISA's Known Exploited Vulnerabilities catalog sits at cisa.gov/known-exploited-vulnerabilities. It's a public list. CVE IDs. Vendor and product names. Vulnerability names. Dates added. Required action language. Due dates for federal civilian agencies under Binding Operational Directive 26-04. You're not hunting a lab recipe. You're learning to read a prioritisation file the whole sector can share on the same morning.

On 2 September 2026 that book grew by seven names. Sangoma Switchvox. Kludex Starlette. Kestra OSS. BerriAI LiteLLM. JFrog Artifactory. Two SonicWall SMA1000 entries. That drop is the reading drill — how a defender walks the page, maps BOD 26-04 clocks, and leaves the exploit path alone. A public catalogue with an evidence-of-exploitation bar is a defence win when the next act is a patch, not a tutorial.

What the catalogue is. KEV is CISA's living list of vulnerabilities that have been exploited in the wild. The agency states the bar in public: a CVE ID, evidence of exploitation, and clear mitigation guidance. There's a nomination path for exploited flaws that aren't listed yet. Federal Civilian Executive Branch agencies get remediation clocks under BOD 26-04 for KEV-listed flaws, especially on publicly exposed assets that grant total control after exploitation. Everyone else still gets a shared urgency signal. That's the design.

Read the KEV before you patch
The Standard illustration

How you walk the page without turning into an attacker. Load cisa.gov/known-exploited-vulnerabilities. Find the newest rows or search the CVE. Read the vendor, product, and vulnerability name exactly as printed. Note the date added. Note the due date column if you're under the directive — or treat secondary reporting of those dates as a calendar hint if you're not. Pull the KEV JSON feed if your team automates diffs against an SBOM or an edge inventory. Diff. Don't dig for a reproduction path in a newspaper.

The 2 September drill, named the way the catalogue names them. CVE-2026-9586, Sangoma Switchvox, SQL injection. CVE-2026-48710, Starlette, HTTP request/response smuggling. CVE-2026-49869, Kestra OSS, OS command injection. CVE-2026-59822, LiteLLM, improper authentication. CVE-2026-82329, JFrog Artifactory, improper authentication. CVE-2026-83548 and CVE-2026-83549, SonicWall SMA1000, server-side request forgery and OS command injection. That is the public book for the day. Vendors have published fixes and advisories in the wider reporting. Your job is inventory, patch, and forensics.

BOD 26-04 is the clock language. CISA's alert for the 2 September set ties the new entries to the directive's risk-based remediation rules and reminds agencies to check whether someone was already in before the patch landed. Secondary wires — including The Hacker News' 2 September filing — put remediation for most of the set around 5 September 2026, with Starlette and LiteLLM stretching to about 16 September. Those are federal clocks. If you're not an FCEB shop, you still own a calendar. Steal the habit of a pre-patch compromise check even when the directive doesn't bind you.

What I will not do here. I will not walk an exploit. I will not paste a proof of concept. I will not describe a payload, a magic header, or a crafted request in enough detail to aim one. I will not turn Switchvox, Starlette, Kestra, LiteLLM, Artifactory, or SMA1000 into homework. Reading KEV is triage literacy. Weaponising the footnotes is someone else's bad idea. If your Tuesday is curiosity, build a patch monitor that diffs the KEV JSON. If your Tuesday is on-call, open the vendor advisory for the product you actually run.

A patient defender's loop, metric and plain. One: pull KEV or the alert. Two: match CVE and product to your CMDB, SBOM, and edge list. Three: assign an owner before standup ends — voice or edge for Sangoma and SonicWall, DevOps for Artifactory, orchestration for Kestra, app owners for Starlette under FastAPI, AI-gateway owners for LiteLLM. Four: patch to the fixed build the vendor names. Five: rotate secrets that might have been touched. Six: verify from logs whether the box was quiet before the fix. Seven: close the change with the CVE string in the ticket title so next week's audit can find it.

Why the 2 September set is a good teaching set. It's not one forgotten server in a closet. It's a phone system, an edge VPN appliance family, an artifact repository, an orchestration platform, a Python web toolkit under a lot of FastAPI estates, and an AI gateway that proxies model calls. Control planes and developer plumbing. KEV doesn't care about your roadmap slide. It cares that someone is already using the hole. The catalogue's job is to say so in a sentence everyone can route into a ticket.

Deadlines again, because clocks are the actionable part. Catalog date: 2 September 2026. Count added: seven. Directive: BOD 26-04. Approximate federal due dates in secondary coverage: about 5 September for five of the seven, about 16 September for Starlette and LiteLLM. As of Sunday 6 September 2026, some of those federal clocks have already rung. If you're late, you're late — patch anyway, then do the compromise check with both eyes open.

How to keep the book honest week to week. Subscribe to CISA's KEV alerts or poll the JSON. Diff against last week's snapshot. Anything new that matches your estate jumps the queue ahead of CVSS theatre that has never been exploited. Anything you don't run gets a one-line "not in inventory" note so nobody re-triages it for sport. Celebrate the machinery: CVE ID, exploitation evidence, mitigation guidance, public dates. That's institutional defence working in the open.

One more habit for teams that live in ticket templates. When the catalogue names a product family you only half-remember — Starlette under a FastAPI service that never appears on the hardware inventory, LiteLLM behind last quarter's AI gateway — write the discovery method into the ticket. How did you find it? SBOM? DNS? Package lockfile? That sentence is how the next person doesn't miss the same box. KEV gave you the CVE. Your estate has to give you the path.

Reading without attacking also means knowing when to stop. The vulnerability name column — SQL injection, request smuggling, command injection, improper authentication, SSRF — is enough urgency for a change window. It is not a licence to search public PoC repositories "just to understand." Understanding, for a defender on this beat, means vendor advisory, fixed version, config flag, and a log query that asks whether anyone was already noisy. Curiosity that needs a payload belongs in a lab you own, with written permission, not in a newspaper howto.

A public list that names exploited bugs is how a sector gets the same prioritisation on the same morning. BOD 26-04 turns that list into federal clocks. The rest of us get a free signal. Read the KEV before you patch. Map the dates. Fix what you run. Leave the how-to-break-it pages for people who don't carry pagers. Catalog, calendar, fix, verify. That's the whole craft.