CISA Flags Critical Langflow, Tomcat, and N-central Flaws in KEV Catalog

Overview/Introduction

On August 5 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced the inclusion of three critical flaws in its Known Exploited Vulnerabilities (KeV) catalog. The catalog is a curated list of vulnerabilities that have been observed in the wild and are therefore subject to mandatory remediation for U.S. federal agencies under Binding Operational Directive (BOD) 22-01. The newly added CVEs are:

• CVE-2026-9198 - IBM Langflow code injection (CVSS 9.8)
• CVE-2026-18556 - N-able N-central authentication bypass (CVSS 8.2)
• CVE-2026-34486 - Apache Tomcat missing encryption of sensitive data (CVSS 7.5)

While each vulnerability targets a different software stack, they share a common thread: active exploitation in the wild and a direct impact on both government and private-sector environments. The Tomcat flaw, in particular, has been linked to an AI-driven autonomous hacking agent that dynamically chained exploits across internet-facing services.

Technical Details

Below is a deeper dive into each CVE, including the vulnerable versions, underlying cause, and known exploitation methods.

CVE-2026-9198 - IBM Langflow Code Injection

Severity: Critical (CVSS 9.8)

Langflow is an open-source, low-code framework for building LLM-driven workflows. Versions 1.0.0 through 1.10.0 contain a deserialization flaw in the /api/v1/execute endpoint. An unauthenticated attacker can supply a crafted JSON payload that triggers arbitrary Java class loading, resulting in remote code execution (RCE) with root privileges on default deployments.

POST /api/v1/execute HTTP/1.1
Host: vulnerable-langflow.example.com
Content-Type: application/json

{"payload":"{malicious serialized object}"}

The vulnerability stems from insecure use of the pickle-like serializer without input validation. Successful exploitation grants full system control, allowing the attacker to modify or exfiltrate data, install backdoors, or pivot to other internal services.

CVE-2026-18556 - N-able N-central Authentication Bypass

Severity: High (CVSS 8.2)

N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and internal IT teams. The flaw resides in the /login API, where an alternate authentication path can be triggered by supplying a specially-crafted X-Forwarded-For header combined with a malformed session cookie. The server mistakenly validates the alternate path before the primary credential check, effectively bypassing authentication.

GET /login HTTP/1.1
Host: ncentral.example.com
X-Forwarded-For: 127.0.0.1
Cookie: session=invalid

Exploitation grants read/write access to the management console, enabling attackers to deploy malicious scripts, harvest credentials, and control managed endpoints.

CVE-2026-34486 - Apache Tomcat Missing Encryption of Sensitive Data

Severity: Medium (CVSS 7.5)

The flaw affects Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116. Tomcat’s EncryptInterceptor is designed to encrypt request parameters marked as sensitive. A misconfiguration in the interceptor chain allows an attacker to bypass encryption when the request contains a specific sequence of URL-encoded characters, causing plaintext transmission of credentials, session tokens, and other secrets.

GET /login?username=admin&password=Secret123 HTTP/1.1
Host: vulnerable-tomcat.example.com

In practice, the bypass can be chained with other vulnerabilities-such as CVE-2026-18556-to achieve full system compromise. Notably, threat intelligence linked exploitation of CVE-2026-34486 to a Chinese-speaking actor employing an AI-powered autonomous hacking agent based on the DeepSeek model. The agent automatically scanned for exposed Tomcat instances, identified the encryption bypass, and proceeded to harvest credentials for lateral movement.

Impact Analysis

The inclusion of these CVEs in the KeV catalog signals that they are not merely theoretical; they have been observed in active campaigns targeting both public and private sectors.

• Federal agencies: Under BOD 22-01, all federal civilian executive branch (FCEB) agencies must remediate by August 7 2026. Failure to do so could result in non-compliance penalties and increased risk of data breach.
• Enterprises and MSPs: Organizations deploying Langflow for AI workflow automation, using Tomcat as an application server, or relying on N-able N-central for endpoint management face immediate risk of remote code execution, credential theft, and full system takeover.
• Supply-chain implications: Many SaaS platforms embed Langflow or Tomcat internally. Compromise of one instance can cascade to downstream services, exposing customer data across multiple tenants.

Given the CVSS scores and observed exploitation, the overall risk rating for affected environments is critical. The combination of unauthenticated RCE (Langflow), authentication bypass (N-central), and data leakage (Tomcat) creates a potent attack surface that can be leveraged for espionage, ransomware, or destructive operations.

Timeline of Events

• June 2026 - Initial discovery of CVE-2026-9198 by independent security researcher; public disclosure on GitHub advisory.
• July 2026 - N-able releases advisory for CVE-2026-18556; patches made available for version 2026.1.
• July 28 2026 - Threat intel reports AI-driven attacks exploiting CVE-2026-34486 against multiple internet-facing Tomcat servers.
• August 5 2026 - CISA adds the three CVEs to the KeV catalog and issues BOD 22-01 remediation deadline of August 7 2026 for federal agencies.
• August 6 2026 - Security community begins widespread patch deployment; several organizations report successful block of attempted exploits.

Mitigation/Recommendations

Below are concrete steps that both federal and private organizations should take immediately.

1. Apply vendor patches:
   • Langflow: Upgrade to version 1.10.1 or later, which disables the vulnerable serializer and adds input sanitization.
   • N-able N-central: Install the 2026.2 update, which enforces strict header validation and adds multi-factor authentication (MFA) for console access.
   • Apache Tomcat: Upgrade to 11.0.21, 10.1.54, or 9.0.117, which corrects the EncryptInterceptor chain and adds default encryption for all request parameters.
2. Network segmentation: Isolate Tomcat and Langflow instances behind internal firewalls; restrict inbound traffic to known IP ranges.
3. Enable MFA and strong password policies: Particularly for N-central consoles, enforce MFA and rotate service-account credentials regularly.
4. Implement Web Application Firewalls (WAF): Deploy rules that block suspicious serialized payloads for Langflow and detect malformed X-Forwarded-For headers for N-central.
5. Log and monitor: Enable detailed request logging on Tomcat (accesslog with pattern=%h %l %u %t "%r" %s %b "%{Referer}i" "%{User-Agent}i") and set up SIEM alerts for abnormal parameter patterns or repeated failed login attempts.
6. Conduct threat-hunt scans: Use vulnerability scanners (e.g., Nessus, OpenVAS) with the latest plugins for CVE-2026-9198, CVE-2026-18556, and CVE-2026-34486 to discover any lingering vulnerable instances.
7. Review AI-driven threat models: The Tomcat case demonstrates that autonomous agents can dynamically pivot between exploits. Incorporate AI-behaviour detection (e.g., anomalous query patterns) into your detection stack.

Real-World Impact

Organizations that ignored the advisories faced immediate consequences. A mid-size MSP reported that an attacker leveraged CVE-2026-18556 to gain console access, then used the platform to distribute ransomware across 150 client endpoints. In another incident, a cloud-native SaaS provider using Langflow for AI-enhanced data processing experienced a breach where the attacker exfiltrated proprietary models and customer PII, later monetizing the data on underground forums.

These incidents underscore the importance of rapid patching and continuous monitoring, especially as threat actors adopt AI tools to automate discovery and exploitation. The AI-powered agent used in the Tomcat attacks demonstrated the ability to adapt on-the-fly, selecting alternative exploits when a primary vector was blocked-an alarming capability that raises the bar for defensive strategies.

Expert Opinion

From a senior analyst perspective, the addition of these three flaws to the KeV catalog is a watershed moment for several reasons:

• Policy enforcement meets technical reality: BOD 22-01 already mandated remediation of known exploited flaws; the rapid August 5 2026 update shows that CISA can respond swiftly when the threat landscape evolves.
• AI-enabled exploitation is no longer a novelty: The Tomcat case proves that autonomous agents can not only locate vulnerabilities but also orchestrate multi-stage attacks without human intervention. Defensive teams must therefore invest in behavioural analytics and AI-aware detection.
• Supply-chain risk amplification: Langflow’s integration into many AI platforms means a single code-injection bug can ripple across dozens of downstream services. Vendors should adopt “defense-in-depth” coding practices, including strict serialization controls and runtime sandboxing.
• RMM platforms remain high-value targets: N-able N-central’s authentication bypass highlights the persistent risk of privileged management tools. Organizations should treat RMM consoles as critical assets, applying zero-trust principles and network micro-segmentation.

Looking ahead, we anticipate that CISA will continue to expand the KeV catalog with AI-related exploits, and that federal agencies will be required to adopt AI-enhanced detection capabilities. For the private sector, the key takeaway is clear: treat CISA advisories as actionable intelligence, not optional reading material. Prompt patching, robust monitoring, and a proactive AI-aware security posture are the only viable defenses against this new generation of autonomous threat actors.