# BerriAI vulnerabilities & exploitation

**CISA KEV**

> As of 2026-11-06, Threadlinqs tracks 8 BerriAI CVEs, 2 in the CISA Known Exploited Vulnerabilities catalog, linked to 34 tracked threat campaigns and 8 named threat actors.

**Data as of:** 2026-11-06

## Exploitation timeline

Threadlinqs has recorded 8 BerriAI CVEs published between 2026-04-15 and 2026-09-15. The busiest month was 2026-05 (3 new CVEs). 2 of them (25%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.

## Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 8 of 8 tracked BerriAI CVEs.

- [CVE-2026-42271](https://intel.threadlinqs.com/cve/CVE-2026-42271) — HIGH 8.8 · KEV · EPSS 92.6% · 2026-05-08
- [CVE-2026-59822](https://intel.threadlinqs.com/cve/CVE-2026-59822) — HIGH 8.2 · KEV · EPSS 0.8% · 2026-07-08
- [CVE-2026-35029](https://intel.threadlinqs.com/cve/CVE-2026-35029) — HIGH 8.8 · EPSS 38.6% · 2026-04-06
- [CVE-2026-40217](https://intel.threadlinqs.com/cve/CVE-2026-40217) — HIGH 8.8 · EPSS 15.5% · 2026-04-10
- [CVE-2026-49468](https://intel.threadlinqs.com/cve/CVE-2026-49468) — HIGH 8.1 · EPSS 3% · 2026-06-22
- [CVE-2026-47101](https://intel.threadlinqs.com/cve/CVE-2026-47101) — HIGH 8.8 · EPSS 1.2% · 2026-05-21
- [CVE-2026-47102](https://intel.threadlinqs.com/cve/CVE-2026-47102) — HIGH 8.8 · EPSS 0.7% · 2026-05-21
- [CVE-2026-59823](https://intel.threadlinqs.com/cve/CVE-2026-59823) — MEDIUM 5.3 · EPSS 0.4% · 2026-09-16

## Products affected

Threadlinqs normalises CPE and CNA product records across all 8 CVEs; 1 distinct BerriAI product is affected. The most frequently affected:

- litellm — 8 CVEs

## Threat activity

34 tracked threat campaigns reference BerriAI products or exploit BerriAI CVEs; the 25 most recent are listed.

- [LLMjacking Bills Reach $1M (Mandiant/GTIG; LiteLLM CVE-2026-40217), Trezor Safe 5 Reseller Implant, SAP Flaws Weaponized Within Days](https://intel.threadlinqs.com/threat/TL-2026-5425) — HIGH — 2026-11-06
- [The Rise of LLMJacking: Threat Actors Monetize Compromised Cloud and Model Resources (UNC6993, D1337-KAIROS, CVE-2026-40217)](https://intel.threadlinqs.com/threat/TL-2026-5064) — HIGH — 2026-11-02
- [LiteLLM Proxy: Four Evolving Exploit Chains (Pre-auth RCE, Internal-User RCE, Master Key Theft) Plus Exploited CVE-2026-42208 SQLi and CVE-2026-30623 MCP stdio Command Injection](https://intel.threadlinqs.com/threat/TL-2026-4936) — CRITICAL — 2026-10-31
- [Pwn2Own Berlin 2026: 47 Zero-Days Demonstrated Against VMware ESXi, Microsoft SharePoint and Exchange, Windows 11, Red Hat Linux, OpenAI Codex and Claude Code](https://intel.threadlinqs.com/threat/TL-2026-4934) — HIGH — 2026-10-31
- [Cybersecurity Black Week: LiteLLM 1.107.0 PyPI/Docker supply-chain compromise, PHP2Shell (CVE-2026-109618/109619), Node2Shell (CVE-2026-111497), GitLab CVE-2026-110264, KSMBD flaws and eMudhra emSign intermediate CA key compromise](https://intel.threadlinqs.com/threat/TL-2026-4706) — CRITICAL — 2026-10-29
- [LiteLLM Supply Chain Compromise (litellm 1.107.0) Targets AI Developer Credentials](https://intel.threadlinqs.com/threat/TL-2026-4326) — CRITICAL — 2026-10-24
- [October 21 Roundup: PHP2Shell (CVE-2026-109618/109619), LiteLLM 1.107.0 Supply-Chain Backdoor, Palo Alto GlobalProtect CVE-2026-0257 Exploitation](https://intel.threadlinqs.com/threat/TL-2026-4251) — CRITICAL — 2026-10-23
- [LiteLLM Supply-Chain Compromise: Malicious v1.107.0 on PyPI and Container Registries Deploys 'privcollect' Credential Stealer and GitHub Dead-Drop Remote Code Loader](https://intel.threadlinqs.com/threat/TL-2026-4042) — CRITICAL — 2026-10-21
- [Pwn2Own Berlin 2026: 47 Zero-Days Disclosed Across AI Products, Exchange, SharePoint, Edge and VMware ESXi](https://intel.threadlinqs.com/threat/TL-2026-3910) — HIGH — 2026-10-19
- [Open Source Supply Chain Attack Surge: 56 Confirmed Attacks in 12 Months Across npm, PyPI, RubyGems, Composer, Rust Crates and GitHub Actions (Shai-Hulud, TeamPCP, Axios, Miasma, ChainDrop)](https://intel.threadlinqs.com/threat/TL-2026-3729) — CRITICAL — 2026-10-16
- [LiteLLM gateway vulnerabilities: missing authorization, SSRF, file read and RCE (CVE-2026-35029, CVE-2026-59823)](https://intel.threadlinqs.com/threat/TL-2026-3417) — HIGH — 2026-10-13
- [PoeLLM (Canto Incognito) malware infects exposed AI servers (LiteLLM, Ollama, Gotenberg, Gitea, Ivanti Sentry) in cryptomining attacks - CVE-2026-42271, CVE-2026-48710](https://intel.threadlinqs.com/threat/TL-2026-3010) — HIGH — 2026-10-07
- [Pwn2Own Ireland 2026 Day 1: 32 zero-days demonstrated against Samsung Galaxy S26, Philips Hue Bridge Pro, Oracle Autonomous AI Database, LiteLLM, OpenAI Codex, Sonos Era 300, Lexmark and Canon printers, and Garmin Index BPM](https://intel.threadlinqs.com/threat/TL-2026-2981) — HIGH — 2026-10-06
- [GTIG: AI-Era Vulnerability Discovery and Exploitation Surge — In-the-Wild Exploitation of BeyondTrust CVE-2026-1731, LiteLLM CVE-2026-42271 and Langflow CVE-2026-5027](https://intel.threadlinqs.com/threat/TL-2026-2818) — CRITICAL — 2026-09-30
- [Qilin-Linked Campaign Exploits MCP Gateway and LLM Framework Flaws (CVE-2026-59822, CVE-2026-42271, CVE-2026-48710) for RCE and Cryptomining](https://intel.threadlinqs.com/threat/TL-2026-2185) — CRITICAL — 2026-08-28
- [Shai-Hulud npm Supply-Chain Worm: Two Alleged TeamPCP Members Charged by AFP/FBI](https://intel.threadlinqs.com/threat/TL-2026-2186) — CRITICAL — 2026-08-28
- [GitHub and PyPI Add Time-Based Defenses Against Supply-Chain Attacks](https://intel.threadlinqs.com/threat/TL-2026-1706) — INFORMATIONAL — 2026-07-26
- [Four Chained Exploit Paths in LiteLLM Proxy (Pre-Auth RCE to Master Key Exfiltration) — STAR Labs Pwn2Own Research](https://intel.threadlinqs.com/threat/TL-2026-1540) — CRITICAL — 2026-07-19
- [LiteLLM Proxy Authentication Bypass via Host Header Injection (CVE-2026-49468)](https://intel.threadlinqs.com/threat/TL-2026-0833) — CRITICAL — 2026-06-17
- [CVE-2026-42271: LiteLLM AI Gateway OS Command Injection via MCP Test Endpoints, Chained to Unauthenticated RCE with CVE-2026-48710 (CISA KEV, Active Exploitation)](https://intel.threadlinqs.com/threat/TL-2026-0730) — CRITICAL — 2026-06-09
- [CVE-2026-42271: LiteLLM MCP Server Command Injection Under Active Exploitation, Chained with CVE-2026-48710 (Starlette BadHost) for Unauthenticated RCE](https://intel.threadlinqs.com/threat/TL-2026-0738) — CRITICAL — 2026-06-09
- [BadHost CVE-2026-48710 — Starlette HTTP Host Header Authentication Bypass Affecting FastAPI/AI Infrastructure (MCP, vLLM, LiteLLM)](https://intel.threadlinqs.com/threat/TL-2026-0606) — CRITICAL — 2026-05-27
- [Pwn2Own Berlin 2026 Day Two: Microsoft Exchange RCE-as-SYSTEM Chain and 14 Other Zero-Days Disclosed](https://intel.threadlinqs.com/threat/TL-2026-1547) — HIGH — 2026-05-15
- [BerriAI LiteLLM Unauthenticated SQL Injection in Proxy API Key Verification (CVE-2026-42208) — CVSS 9.8, CISA KEV](https://intel.threadlinqs.com/threat/TL-2026-0506) — CRITICAL — 2026-05-13
- [GTIG AI Threat Tracker (May 2026) — First AI-Developed Zero-Day Exploit (2FA Bypass), PROMPTFLUX/HONESTCUE/CANFAIL/LONGSTREAM/PROMPTSPY AI-Enabled Malware, and APT27/APT45/UNC2814/UNC5673/UNC6201/TeamPCP AI-Augmented Operations](https://intel.threadlinqs.com/threat/TL-2026-0495) — HIGH — 2026-05-11

## Threat actors targeting BerriAI

Named threat actors attributed to campaigns that involve BerriAI products or CVEs, with the number of linked campaigns:

- [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) — 10 campaigns
- [UNC6993](https://intel.threadlinqs.com/actor/UNC6993) — 2 campaigns
- [Vect Ransomware](https://intel.threadlinqs.com/actor/Vect%20Ransomware) — 2 campaigns
- [APT27](https://intel.threadlinqs.com/actor/APT27) — 1 campaign
- [UNC2814](https://intel.threadlinqs.com/actor/UNC2814) — 1 campaign
- [UNC6201](https://intel.threadlinqs.com/actor/UNC6201) — 1 campaign
- [UNC6780](https://intel.threadlinqs.com/actor/UNC6780) — 1 campaign
- [VECT](https://intel.threadlinqs.com/actor/VECT) — 1 campaign

## How to prioritise BerriAI patching

This order follows the data Threadlinqs holds for BerriAI, not a generic severity checklist:

- 2 of 8 BerriAI CVEs (25%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2026-42271](https://intel.threadlinqs.com/cve/CVE-2026-42271), [CVE-2026-59822](https://intel.threadlinqs.com/cve/CVE-2026-59822).
- Outside KEV, the highest EPSS scores are [CVE-2026-35029](https://intel.threadlinqs.com/cve/CVE-2026-35029) (38.6%), [CVE-2026-40217](https://intel.threadlinqs.com/cve/CVE-2026-40217) (15.5%), [CVE-2026-49468](https://intel.threadlinqs.com/cve/CVE-2026-49468) (3%).
- 0 CVEs score Critical and 7 High on CVSS v3 (maximum 8.8, average 8.2); sequence these after KEV and high-EPSS items.
- 7 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

## About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-11-06 and refresh daily.

Canonical: https://intel.threadlinqs.com/vendors/berriai
All vendors: https://intel.threadlinqs.com/vendors
Full detection coverage and IOCs for threats exploiting BerriAI products unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp