CISA Adds Critical Vulnerabilities in Langflow, Tomcat, and N-central to KEV Catalog
On August 5, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. The vulnerabilities include CVE-2026-9198, a critical code injection flaw in Langflow allowing unauthenticated remote code execution; CVE-2026-34486, a missing encryption vulnerability in Apache Tomcat enabling bypass of EncryptInterceptor; and CVE-2026-18556, an authentication bypass in N-able N-central. These flaws have been exploited by threat actors, including AI-enabled autonomous hacking campaigns attributed to Chinese-speaking adversaries, targeting internet-exposed devices and government infrastructure across over 100 countries. The inclusion of these vulnerabilities in the KEV catalog underscores the escalating threat posed by sophisticated cyber actors leveraging both manual and autonomous techniques to exploit critical infrastructure. Organizations are urged to apply the necessary patches promptly to mitigate potential risks associated with these actively exploited vulnerabilities.
Kill Chain
