CISA Adds Critical Vulnerabilities in Langflow, Tomcat, and N-central to KEV Catalog
Executive Summary
On August 5, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. The vulnerabilities include CVE-2026-9198, a critical code injection flaw in Langflow allowing unauthenticated remote code execution; CVE-2026-34486, a missing encryption vulnerability in Apache Tomcat enabling bypass of EncryptInterceptor; and CVE-2026-18556, an authentication bypass in N-able N-central. These flaws have been exploited by threat actors, including AI-enabled autonomous hacking campaigns attributed to Chinese-speaking adversaries, targeting internet-exposed devices and government infrastructure across over 100 countries.
The inclusion of these vulnerabilities in the KEV catalog underscores the escalating threat posed by sophisticated cyber actors leveraging both manual and autonomous techniques to exploit critical infrastructure. Organizations are urged to apply the necessary patches promptly to mitigate potential risks associated with these actively exploited vulnerabilities.
Why This Matters Now
The active exploitation of these vulnerabilities by advanced threat actors highlights the urgent need for organizations to patch affected systems immediately to prevent potential breaches and data compromises.
Attack Path Analysis
An attacker exploited a code injection vulnerability in Langflow (CVE-2026-9198) to achieve remote code execution, then escalated privileges by exploiting an authentication bypass in N-able N-central (CVE-2026-18556). They moved laterally by leveraging a missing encryption flaw in Apache Tomcat (CVE-2026-34486) to intercept sensitive data, established command and control channels, exfiltrated data, and caused significant impact by deploying malware.
Kill Chain Progression
Initial Compromise
Description
The attacker exploited a code injection vulnerability in Langflow (CVE-2026-9198) to achieve remote code execution on the target system.
Related CVEs
CVE-2026-9198
CVSS 9.8IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments.
Affected Products:
IBM Langflow OSS – 1.0.0, 1.10.0
Exploit Status:
exploited in the wildCVE-2026-34486
CVSS 9.8Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.
Affected Products:
Apache Tomcat – 11.0.20, 10.1.53, 9.0.116
Exploit Status:
exploited in the wildCVE-2026-18556
CVSS 7.4An authentication bypass vulnerability in N-able N-central.
Affected Products:
N-able N-central – < 2026.1
Exploit Status:
exploited in the wildCVE-2026-18577
CVSS 8.1An incomplete fix for CVE-2026-18556 in N-able N-central, leading to continued authentication bypass.
Affected Products:
N-able N-central – < 2026.1
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Command and Scripting Interpreter
Valid Accounts
Hijack Execution Flow
Network Service Scanning
Remote Services
Impair Defenses
Data Encrypted for Impact
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Asset Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Critical exposure to Langflow RCE and Apache Tomcat vulnerabilities enables Advanced Persistent Threats targeting cloud infrastructure and AI platforms through autonomous exploitation.
Government Administration
Federal agencies face imminent August 7th remediation deadline for actively exploited CVEs, with China-nexus APT campaigns targeting government infrastructure across 100+ countries.
Computer Software/Engineering
Software development environments vulnerable to code injection attacks via Langflow AI platforms and Apache Tomcat clusters, enabling lateral movement and exfiltration.
Telecommunications
Network infrastructure exposed to encrypted traffic bypass vulnerabilities and east-west lateral movement through compromised Apache Tomcat cluster communications and VPN endpoints.
Sources
- CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploitedhttps://thehackernews.com/2026/08/cisa-flags-langflow-rce-tomcat-and-n.htmlVerified
- CISA Adds Three Known Exploited Vulnerabilities to Cataloghttps://www.cisa.gov/news-events/alerts/2026/08/04/cisa-adds-three-known-exploited-vulnerabilities-catalogVerified
- IBM Security Bulletin: Vulnerability in Langflow OSShttps://www.ibm.com/support/pages/node/7278927Verified
- Apache Tomcat Security Advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-34486Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Implementing Aviatrix Zero Trust CNSF would likely have constrained the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and identity-based access controls.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While Aviatrix CNSF may not prevent the initial exploitation, it would likely limit the attacker's ability to leverage the compromised system to access other workloads.
Control: Zero Trust Segmentation
Mitigation: Aviatrix Zero Trust Segmentation would likely limit the attacker's ability to escalate privileges by enforcing strict identity-based access controls.
Control: East-West Traffic Security
Mitigation: Aviatrix East-West Traffic Security would likely limit the attacker's ability to move laterally by enforcing strict segmentation and monitoring of internal traffic.
Control: Multicloud Visibility & Control
Mitigation: Aviatrix Multicloud Visibility & Control would likely limit the attacker's ability to establish and maintain command and control channels by providing comprehensive monitoring and control over network traffic.
Control: Egress Security & Policy Enforcement
Mitigation: Aviatrix Egress Security & Policy Enforcement would likely limit the attacker's ability to exfiltrate data by enforcing strict egress policies and monitoring outbound traffic.
While Aviatrix CNSF may not prevent the deployment of malware, it would likely limit the spread and impact by enforcing strict segmentation and access controls.
Impact at a Glance
Affected Business Functions
- Application Development
- Web Services
- IT Infrastructure
Estimated downtime: 7 days
Estimated loss: $500,000
Potential exposure of sensitive application data and user credentials.
Recommended Actions
Key Takeaways & Next Steps
- • Implement inline intrusion prevention systems (IPS) to detect and block known exploit patterns, mitigating vulnerabilities like CVE-2026-9198.
- • Enforce zero trust segmentation to limit lateral movement by restricting access between workloads and services.
- • Apply east-west traffic security controls to monitor and control internal network communications, preventing unauthorized data interception.
- • Utilize multicloud visibility and control solutions to detect and respond to anomalous activities across cloud environments.
- • Establish egress security and policy enforcement mechanisms to prevent unauthorized data exfiltration and command and control communications.
