Will MLflow vulnerability be added to CISA KEV by September 2026?

CISA has warned that threat actors are actively exploiting a critical vulnerability in MLflow, an open-source AI engineering platform. This signals imminent KEV addition and wider adoption of the exploit. Resolution: official CISA KEV catalog addition or public disclosure of exploitation by security vendor.

Resolution Criteria

Vulnerability appears in CISA's Known Exploited Vulnerabilities (KEV) Catalog, OR official CISA advisory/Bleeping Computer or similar reputable source confirms active exploitation with specific attack details by September 2026.