The seven additions to the Known Exploited Vulnerabilities catalog landed on September 2, and CISA's Binding Operational Directive 26-04 gives federal civilian agencies until September 5 to fix most of them. Two stand out. SonicWall's SMA1000 remote-access appliances carry CVE-2026-83548, a pre-authentication server-side request forgery rated a full 10.0. Chained with a post-auth command-injection flaw, CVE-2026-83549, it yields unauthenticated remote code execution — and the vendor disclosed active exploitation a day before the KEV listing. Sangoma's Switchvox is the other: CVE-2026-9586, an unauthenticated SQL injection leading to RCE at CVSS 9.3, hit in the wild since August 30 across roughly 4,000 exposed instances. The rest fill out the batch: an OS-command-injection hole in Kestra OSS that one crew used to drop a crypto miner, an improper-auth bug in JFrog Artifactory, and request-smuggling and auth flaws in Starlette and LiteLLM (those last two exempt from the deadline). You don't have to be a federal agency for this to matter. If you run an SMA1000 or a Switchvox on the public internet, both are being exploited now and patches are out. Do it before the weekend.