CISA: three actively exploited flaws in Langflow, N-central and Apache Tomcat

CISA has added three vulnerabilities to its KEV (Known Exploited Vulnerabilities) catalog, all with evidence of active exploitation. They sit in very different products — an AI-agent framework, an RMM platform and an application server — but they share one thing: they are no longer theoretical. Below: what they are and what to do.

In brief

• CVE-2026-9198 — IBM Langflow — unauthenticated RCE, CVSS 9.8. The attacker chains two API endpoints to bypass login and run code on default deployments. Public PoC since late July.
• CVE-2026-18576 — N-able N-central — authentication bypass: administrator account takeover without authentication. All versions before 2026.3 are affected; emergency hotfix released on August 1st. Actively exploited; a new method appeared right after the initial patch.
• CVE-2026-34486 — Apache Tomcat — CVSS 7.5, an incomplete fix of a prior vulnerability (CVE-2026-29146, 9.8, missing encryption of sensitive data). Chinese-speaking actors attempted manual exploitation on nine Tomcat servers (July 30).
• Ransomware: CISA did not specify the attack types and it is unknown whether they are used in ransomware campaigns.

What they are, one by one

IBM Langflow (CVE-2026-9198). Langflow is a visual framework for building AI agents. The vulnerability lets an unauthenticated attacker execute code remotely on default deployments, by chaining two API endpoints that together bypass authentication. Fully functional PoC exploits are already public. It is not the product’s first critical issue — previously, CVE-2026-0770 allowed root-level RCE.

N-able N-central (CVE-2026-18576). N-central is an RMM platform — remote monitoring and management, typically used by MSPs to administer whole fleets of systems. An authentication bypass granting admin access is, in such a product, a key to many customers at once. All versions before 2026.3 are affected; the vendor released an emergency hotfix on August 1st, after a new exploitation method appeared right after the initial patch.

Apache Tomcat (CVE-2026-34486). An incomplete fix of a prior vulnerability (CVE-2026-29146, related to missing encryption of sensitive data). Chinese-speaking actors attempted manual exploitation on nine Tomcat servers on July 30.

Why KEV matters

Entering KEV is not a severity rating — it is a statement about reality: these vulnerabilities are being exploited now. For US federal agencies, KEV triggers a mandatory remediation deadline (the BOD 22-01 mechanism). For everyone else, the KEV catalog is the best free priority list there is: if you run any of these products, their patch jumps to the top, ahead of the “merely theoretical” ones.

Our recommendations

• Track KEV as a prioritization source. Not all CVEs are equal; the ones in KEV are already being exploited. A process that ties your asset inventory to the KEV catalog tells you in minutes whether you are exposed. Part of the security audit and vulnerability management.
• Do not expose admin and development tools to the internet. RMM platforms (N-central) and AI-agent frameworks (Langflow) have no business directly exposed publicly. Segmentation, VPN/conditional access, allowlisting — monitoring and periodic review catch exposures that appear by mistake.
• Check what is actually reachable from outside. A security test confirms whether these services are reachable and exploitable from an attacker’s position, not just in theory.

Running Langflow, N-central or Tomcat and want to know if you are exposed? Get in touch and we start with an audit.