U.S. CISA adds Langflow, Apache Tomcat, and N-able N-central flaws to its Known Exploited Vulnerabilities catalog
The U.S. government has confirmed attackers are already exploiting critical bugs in an AI tool, a foundational web server, and a major IT management platform, giving all affected organizations a hard deadline to act.
According to an alert from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), three high-severity vulnerabilities have been added to its Known Exploited Vulnerabilities (KEV) catalog with a federal remediation deadline of August 7, 2026. The move, based on evidence of active exploitation, mandates immediate action from federal agencies and serves as a critical warning for the private sector.
The newly listed flaws are:
- CVE-2026-9198 (CVSS 9.8): A critical code injection vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0.
- CVE-2026-18556 (CVSS 8.2): An authentication bypass flaw in N-able N-central versions through 2026.1.
- CVE-2026-34486 (CVSS 7.5): A missing encryption flaw in specific versions of Apache Tomcat (11.0.20, 10.1.53, 9.0.116).
What Makes These Three Vulnerabilities Urgent Enough for a KEV Listing?
CISA doesn't add bugs to its catalog lightly. A KEV listing requires clear evidence that malicious actors are actively using the flaw to breach systems. These three entries represent a dangerous mix of emerging and established infrastructure under attack.
The Langflow vulnerability (CVE-2026-9198) is particularly severe. With a CVSS score of 9.8, it allows unauthenticated attackers to mint a superuser token and then execute arbitrary Python code on the host server. On default deployments, this translates directly to full system compromise. As AI application infrastructure becomes more pervasive, flaws like this offer attackers a potent new beachhead.
The Apache Tomcat flaw (CVE-2026-34486) is notable because it bypasses a previous fix (for CVE-2026-29146) for the EncryptInterceptor, a component meant to protect sensitive cluster traffic. Its exploitation has been linked by researchers to a Chinese-speaking threat actor using an AI-powered autonomous hacking agent to find and exploit such weaknesses.
The N-able N-central bug (CVE-2026-18556) is an authentication bypass in a widely used Remote Monitoring and Management (RMM) platform. Gaining unauthorized access to such a tool is a prime objective for ransomware groups and espionage actors, as it provides deep control over managed endpoints and networks.
CISA's statement is clear: "These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise."
How Are Attackers Actually Exploiting These Bugs?
Understanding the mechanics explains the urgency. These aren't theoretical weaknesses, they are documented avenues for immediate compromise.
For Langflow (CVE-2026-9198):
The attack chain is straightforward for an unauthenticated attacker. First, they hit the /api/v1/auto_login endpoint to generate a valid superuser bearer token. Then, using that token, they submit malicious Python code to the /api/v1/validate/code endpoint, where the exec() function evaluates it, leading to remote code execution (RCE). IBM's advisory lists no workaround, only an upgrade to version 1.10.1.
For Apache Tomcat (CVE-2026-34486):
This flaw allows an attacker to bypass the EncryptInterceptor, potentially exposing sensitive data in cluster communications. Affected organizations must upgrade to the patched versions: Tomcat 11.0.21, 10.1.54, or 9.0.117. The exploitation confirms that even patched, foundational software like Tomcat remains a high-value target for automated and manual attacks.
For N-able N-central (CVE-2026-18556):
This vulnerability allows attackers to access the N-central platform "using an alternate path or channel," bypassing normal login requirements entirely. N-able's emergency guidance is to upgrade to version 2026.3.1.7 and immediately investigate for signs of post-exploitation activity, such as unauthorized use of the "Take Control" feature or Cloudflare Tunnel persistence mechanisms.
What Should Organizations Do Before the August 7 Deadline?
The August 7 date is a binding deadline for U.S. federal agencies under Binding Operational Directive (BOD) 26-04. For private sector organizations, it's a stark indicator that time is already up. Patching must happen on an exposure-based timeline, not a calendar-based one.
XOOMAR Analysis: The inclusion of Langflow is a signal. It shows that AI application infrastructure is now a mature attack surface. The Tomcat entry highlights the perpetual risk in widely used open-source DevOps components. The N-central flaw underscores the massive leverage gained by compromising IT management tools.
A simple patch is not enough. Each vulnerability requires a specific response:
| Vulnerability | Primary Action | Critical Follow-Up |
|---|---|---|
| Langflow CVE-2026-9198 | Upgrade to Langflow OSS 1.10.1. | Treat exposed instances as compromised. Hunt for descendant processes, outbound calls, and rotate all accessible secrets. |
| Tomcat CVE-2026-34486 | Upgrade to patched versions (11.0.21, 10.1.54, 9.0.117). | Review cluster member telemetry for unexpected peers or unencrypted replication traffic. |
| N-central CVE-2026-18556 | Upgrade to N-central 2026.3.1.7. | Audit managed endpoints for unauthorized Take Control sessions, Cloudflare Tunnels, or other persistence. |
CISA's catalog confirms the fact of exploitation, but it deliberately does not link these three flaws to a single campaign or actor. Organizations must avoid conflating them. The common thread is not a shared hacker group, but the high utility each flaw provides for establishing a foothold, moving laterally, and stealing data.
This escalation in automated exploitation, as seen with the AI agent targeting Tomcat, is fueling a defensive arms race. The forward look is clear: the KEV catalog will continue to grow with flaws that meet its strict criteria of proof. For security teams, the immediate task is remediation and hunting based on these three entries. The longer-term lesson is to expect the same level of scrutiny and attacker interest on any new tool, especially in AI and automation, that gets integrated into core business operations. The weaponization cycle is only getting faster.
Impact Analysis
- Federal agencies and private sector organizations using these technologies now have a hard remediation deadline of August 7, 2026, enforced by CISA.
- The confirmed active exploitation means these three bugs, especially the critical (CVSS 9.8) Langflow flaw, present an immediate and severe risk of system takeover.
- This KEV listing signals attackers are targeting both emerging AI infrastructure (Langflow) and foundational web hosting (Tomcat), broadening the attack surface for many organizations.
Originally published on XOOMAR. For more news and analysis, visit XOOMAR.
Top comments (0)