Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on August 5, 2026, added three flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The list of vulnerabilities is as follows - CVE-2026-9198 (CVSS score: 9.8) - A code injection vulnerability in Langflow that allows unauthenticated attackers to achieve full remote
Analysis Summary
# Vulnerability: Critical RCE in Langflow and Multi-Product Exploitation
## CVE Details
- **CVE ID:** CVE-2026-9198
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-94 (Code Injection)
## Affected Systems
- **Products:** Langflow (Open-source AI application development platform)
- **Versions:** All versions prior to 1.10.1
- **Configurations:** Default Langflow deployments are primarily targeted.
## Vulnerability Description
CVE-2026-9198 is a critical code injection vulnerability. It allows an unauthenticated remote attacker to inject and execute arbitrary code within the context of the application. Due to the nature of Langflow as an AI orchestration tool, successful exploitation typically results in full Remote Code Execution (RCE) on the underlying host.
## Exploitation
- **Status:** Actively exploited in the wild (Added to CISA KEV on August 5, 2026).
- **Complexity:** Low
- **Attack Vector:** Network
- **PoC Availability:** Not explicitly linked in this report, but weaponized AI agents and ransomware groups (e.g., EncForge) are reportedly utilizing similar Langflow RCE flaws.
## Impact
- **Confidentiality:** High (Full access to data and AI models)
- **Integrity:** High (Ability to modify application logic and system files)
- **Availability:** High (Potential for complete system takeover or ransomware encryption)
## Remediation
### Patches
- **Langflow version 1.10.1:** Released in July 2026 to address this specific flaw.
### Workarounds
- Restrict network access to Langflow interfaces using firewalls or VPNs.
- Avoid exposing default deployments to the public internet.
- Implement strict ingress filtering for AI orchestration endpoints.
## Detection
- **Indicators of Compromise:** Unusual outbound network traffic from AI hosting environments; unauthorized creation of new flows or API keys; presence of Monero miners or EncForge ransomware artifacts.
- **Detection methods and tools:** Audit application logs for suspicious code injection patterns in HTTP requests. CISA recommends FCEB agencies use automated scanning to identify internet-facing Langflow instances.
## References
- CISA KEV Catalog: hxxps[://]www.cisa.gov/known-exploited-vulnerabilities-catalog
- IBM Support Advisory: hxxps[://]www.ibm.com/support/pages/node/7278927
- Unit 42 Analysis: hxxps[://]unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/
---
# Secondary Vulnerabilities in Recent KEV Update
| CVE | Product | CVSS | Description |
| :--- | :--- | :--- | :--- |
| **CVE-2026-34486** | Apache Tomcat | 7.5 | Missing encryption in `EncryptInterceptor` allowing cluster message interception. |
| **CVE-2026-18556** | N-able N-central | 8.2 | Authentication bypass vulnerability (precursor to CVE-2026-18577). |
**Note:** CVE-2026-34486 is notably being exploited by an AI-enabled autonomous hacking campaign using the "Hermes Agent" framework and DeepSeek LLM for target identification.