Will MLflow vulnerability be added to CISA KEV by end of September 2026?

CISA warned on 2026-08-21 that threat actors are actively exploiting a critical vulnerability in the MLflow open-source AI engineering platform (Bleeping Computer). MLflow is widely used in AI/ML pipelines, making exploitation of this vulnerability a high-priority KEV candidate.

Resolution Criteria

Confirmed by CISA's official Known Exploited Vulnerabilities Catalog listing the specific MLflow vulnerability (by CVE identifier once disclosed) with evidence of active exploitation by the deadline.