CISA Warns of Exploited Vulnerabilities in Langflow, N-central, and Tomcat

CISA issued a warning regarding the active exploitation of three critical vulnerabilities affecting IBM Langflow OSS, N-able N-central, and Apache Tomcat.

CISA Urgent Advisory on Exploited Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical warning about the active exploitation of three high-severity vulnerabilities in widely used software systems. These flaws, affecting IBM Langflow OSS, N-able N-central, and Apache Tomcat, are being leveraged by malicious actors to execute remote code through unauthenticated access. The vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, emphasizing the urgency for organizations to apply patches.

Vulnerability 1: IBM Langflow OSS (CVE-2026-9198)

Overview

CVE-2026-9198, with a CVSS score of 9.8, is a critical flaw in IBM Langflow OSS. It allows attackers to combine two API endpoints to achieve remote code execution. The vulnerability arises from an unauthenticated endpoint that generates superuser bearer tokens and a code validation endpoint that executes arbitrary Python code.

Patch and Exploitation

IBM released patches for this issue in version 1.10.1 of Langflow OSS on July 17. All default configurations are vulnerable. Attackers can exploit this by first obtaining a superuser token via the auto-login endpoint and then injecting malicious code into the validation endpoint. A proof-of-concept exploit was shared one week after disclosure, prompting CISA to add it to its KEV catalog on August 4.

Vulnerability 2: N-able N-central (CVE-2026-18556)

Overview

CVE-2026-18556, with a CVSS score of 7.4, is an authentication bypass flaw in N-able N-central. Threat actors used this as a zero-day to gain administrative access to systems managed through its remote monitoring and management (RMM) platform.

Patch and Escalation

The initial patch for this issue was insufficient, allowing attackers to bypass the fix. N-able deployed a hotfix in late July, which led to the creation of a follow-up vulnerability, CVE-2026-18577. Both flaws are now listed in CISA’s KEV catalog.

Vulnerability 3: Apache Tomcat (CVE-2026-34486)

Overview

CVE-2026-34486, with a CVSS score of 7.5, involves an EncryptInterceptor bypass in Apache Tomcat. The flaw was resolved in April as part of a patch for CVE-2026-29146, a padding oracle issue in the EncryptInterceptor component.

Exploitation and Impact

StrigaAI, which identified the flaw, explained that the fix altered the encryption layer’s behavior from fail-closed to fail-open, enabling unauthenticated remote code execution. Recent reports from SOCRadar and Palo Alto Networks indicate that a Chinese threat actor exploited this vulnerability in attacks involving the Snowlight malware family and an AI-driven autonomous hacking campaign.

Conclusion

CISA’s advisory underscores the urgency of applying patches to mitigate risks associated with these actively exploited flaws. Organizations are strongly encouraged to review their systems, apply the latest updates, and monitor for signs of exploitation. Failure to address these vulnerabilities could lead to severe consequences, including data breaches and system compromises.

FAQs

What are the key vulnerabilities highlighted by CISA?

CISA highlighted three critical vulnerabilities: CVE-2026-9198 (IBM Langflow OSS), CVE-2026-18556 (N-able N-central), and CVE-2026-34486 (Apache Tomcat). These flaws allow remote code execution and are actively exploited by malicious actors.

Why is CISA issuing this warning?

CISA is issuing this warning to ensure organizations address these vulnerabilities promptly. The flaws are being exploited in real-world attacks, and failure to patch could lead to significant security risks, including unauthorized access and data breaches.

What steps should organizations take?

Organizations should apply the latest patches for affected systems, review their configurations, and monitor for signs of exploitation. Federal agencies must comply with BOD 26-04 by August 7 to mitigate risks.

About Author

Anuj

See author's posts