The US Cybersecurity and Infrastructure Security Agency (CISA) has added three actively exploited vulnerabilities affecting IBM Langflow, N-able N-central, and Apache Tomcat to its Known Exploited Vulnerabilities catalog.
Federal agencies have been given three days to apply available mitigations. The vulnerabilities could allow attackers to run code remotely, hijack administrative accounts, or gain a foothold on vulnerable servers.
CISA did not disclose the specific attacks using the flaws. It also said it was unknown whether ransomware operators have used any of the vulnerabilities.
However, the agency’s addition of all three issues to the CISA KEV catalog confirms that threat actors are exploiting them in the wild.
Critical Langflow Flaw Allows Remote Code Execution
The most severe issue affects IBM Langflow, a visual framework used to build AI agents.
Tracked as CVE-2026-9198, the flaw has a critical severity score of 9.8 out of 10. It can allow an unauthenticated attacker to execute code remotely on default Langflow deployments.
Attackers can reportedly chain two API endpoints to bypass authentication and run commands on an affected system.
Multiple fully functional proof-of-concept exploits for the vulnerability emerged publicly in late July. The published material included instructions that could help attackers abuse the flaw.
CISA had also warned about another critical Langflow vulnerability, CVE-2026-0770, two weeks earlier. That issue was exploited to gain remote code execution with root privileges.
Organisations running Langflow should review their deployments immediately and apply all available security updates and mitigations.
N-central Bug Lets Attackers Hijack Admin Accounts
The second vulnerability affects N-able N-central, a remote monitoring and management platform widely used by managed service providers.
Tracked as CVE-2026-18576, the high-severity flaw can allow attackers to take over administrator accounts without authentication.
N-able previously released a patch for the issue. However, the company said the initial fix was insufficient after attackers found another way to exploit the vulnerability.
On August 1, N-able warned customers that hackers were actively abusing the flaw. The company later released an emergency hotfix and urged customers to install it.
The issue affects N-central versions released before 2026.3.
Because remote monitoring platforms can provide access to many managed devices, attacks against N-central may create risks beyond a single organisation. Managed service providers should treat the update as a priority and review their environments for suspicious activity.
Apache Tomcat Vulnerability Used to Plant Reverse Shells
The third flaw affects Apache Tomcat and is tracked as CVE-2026-34486.
It has a high severity score of 7.5 and stems from an incomplete fix for CVE-2026-29146, a critical issue with a 9.8 severity rating involving missing encryption of sensitive data.
Researchers at Palo Alto Networks Unit 42 reported on July 30 that a Chinese-speaking threat actor had attempted to exploit CVE-2026-34486 in a manual campaign.
The attackers targeted nine Apache Tomcat servers and attempted to deploy reverse shells, which can give criminals persistent remote access to compromised systems.
CISA’s latest action highlights the importance of rapid patching for publicly exposed services. Organisations using Langflow, N-central, or Apache Tomcat should identify vulnerable systems, apply vendor-provided fixes, and monitor logs for signs of attempted exploitation.
0 responses to “CISA Warns of Active Exploits Targeting Langflow, N-central and Tomcat”