Full Report
The U.S. Cybersecurity and Infrastructure Security Agency is giving federal agencies three days to mitigate vulnerabilities in IBM Langflow, N-central, and Apache Tomcat, all actively exploited. [...]
Analysis Summary
Based on the provided article, here is the summary of the three vulnerabilities recently added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
---
# Vulnerability: IBM Langflow Remote Code Execution
## CVE Details
- **CVE ID:** CVE-2026-9198
- **CVSS Score:** 9.8 (Critical)
- **CWE:** Not specified (Authentication Bypass/RCE)
## Affected Systems
- **Products:** IBM Langflow (Visual framework for building AI agents)
- **Versions:** Default deployments
- **Configurations:** Default installations are specifically mentioned as vulnerable.
## Vulnerability Description
The flaw allows an unauthenticated attacker to achieve remote code execution (RCE). The attack is carried out by chaining two specific API endpoints to bypass the login mechanism, subsequently allowing the execution of arbitrary code on the host.
## Exploitation
- **Status:** Exploited in the wild; multiple fully functional PoCs available publicly.
- **Complexity:** Low (Instructions and PoCs are publicly available).
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High
- **Integrity:** High
- **Availability:** High
## Remediation
### Patches
- Federal agencies are mandated by CISA to mitigate by August 7, 2026. Users should refer to IBM's latest security bulletins for Langflow updates.
---
# Vulnerability: N-able N-central Authentication Bypass
## CVE Details
- **CVE ID:** CVE-2026-18576
- **CVSS Score:** High Severity (Score not explicitly stated in text)
- **CWE:** Authentication Bypass
## Affected Systems
- **Products:** N-able N-central (Remote monitoring and management platform)
- **Versions:** All versions prior to 2026.3
## Vulnerability Description
This vulnerability allows attackers to hijack administrative accounts without authentication. It is noted as an "insufficient fix" for a previous flaw; threat actors discovered an alternative path to exploit the same underlying authentication logic.
## Exploitation
- **Status:** Exploited in the wild.
- **Complexity:** Not specified (assumed Low given it is an auth bypass).
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High
- **Integrity:** High
- **Availability:** High (Administrative takeover)
## Remediation
### Patches
- **Emergency Hotfix:** Released Sunday (August 3, 2026).
- **Version:** Upgrade to N-central 2026.3 or apply the specific emergency hotfix.
---
# Vulnerability: Apache Tomcat Information Disclosure/RCE
## CVE Details
- **CVE ID:** CVE-2026-34486
- **CVSS Score:** 7.5 (High)
- **CWE:** Missing Encryption of Sensitive Data
## Affected Systems
- **Products:** Apache Tomcat
- **Versions:** Not specified (Incomplete fix for CVE-2026-29146)
## Vulnerability Description
This flaw stems from an incomplete fix for a previous critical vulnerability (CVE-2026-29146) related to missing encryption for sensitive data. While the flaw itself is categorized under data encryption, it is being actively leveraged to gain further access to systems.
## Exploitation
- **Status:** Exploited in the wild (Manual campaigns by Chinese-speaking threat actors).
- **Complexity:** Medium
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High
- **Integrity:** High (Used to plant reverse shells)
- **Availability:** High
## Remediation
### Patches
- Apply the latest security updates provided by the Apache Software Foundation for Tomcat.
---
## Detection (General for all three)
- **Indicators of Compromise:**
- For **Apache Tomcat**: Look for unauthorized reverse shell activity or connections to suspicious external IPs as reported by Unit 42.
- For **Langflow**: Monitor API logs for unusual chaining of endpoints or unauthorized code execution attempts.
- **Detection Methods:** Breach and attack simulation (BAS), SIEM/EDR rule verification, and regular vulnerability scanning for the specific CVEs mentioned.
## References
- **IBM/Langflow:** hxxps[://]www[.]bleepingcomputer[.]com/news/security/cisa-orders-feds-to-patch-actively-exploited-langflow-rce-flaw/
- **N-able Advisory:** hxxps[://]www[.]bleepingcomputer[.]com/news/security/n-able-warns-of-n-central-auth-bypass-flaw-exploited-in-attacks/
- **CISA KEV Catalog:** hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- **Unit 42 Report:** hxxps[://]unit42[.]paloaltonetworks[.]com/autonomous-ai-cyber-attack-campaign/