The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical warning regarding three actively exploited vulnerabilities impacting IBM Langflow OSS, N-able N-central, and Apache Tomcat. Threat actors are leveraging these flaws for remote code execution (RCE) and authentication bypass, prompting CISA to add all three to its Known Exploited Vulnerabilities (KEV) catalog. This advisory underscores the immediate and severe risk these vulnerabilities pose to organizations utilizing the affected software, urging rapid remediation according to SecurityWeek.
Technical Analysis of Exploited Vulnerabilities
IBM Langflow OSS Remote Code Execution (CVE-2026-9198)
CISA has flagged CVE-2026-9198, an unauthenticated remote code execution vulnerability in IBM Langflow OSS. With a CVSS score of 9.8, this critical flaw allows attackers to chain two distinct API endpoints. Specifically, an unauthenticated endpoint issues superuser bearer tokens to any network caller, which can then be used with a code validation endpoint to execute arbitrary Python code. IBM disclosed and patched this vulnerability in Langflow OSS version 1.10.1 on July 17, warning that all default deployments were affected. Proof-of-concept (PoC) code was publicly released approximately a week after disclosure, highlighting the urgency for organizations to understand how attackers exploit Langflow OSS RCE CVE-2026-9198 and apply patches without delay.
N-able N-central Authentication Bypass (CVE-2026-18556 & CVE-2026-18577)
The N-able N-central remote monitoring and management (RMM) platform is impacted by two related vulnerabilities now in CISA’s KEV catalog. The primary issue, CVE-2026-18556 (CVSS 7.4), is an authentication bypass that threat actors exploited as a zero-day to gain administrative access to systems managed via the platform. N-able initially released a fix, but exploitation activity intensified by the end of July as threat actors bypassed this initial patch. This led to the issuance of CVE-2026-18577, which addresses the patch bypass. The confirmed zero-day exploitation and subsequent bypass demonstrate a persistent threat, emphasizing the need for immediate attention to N-able N-central authentication bypass CVE-2026-18556 mitigation strategies.
Addressing Apache Tomcat CVE-2026-34486 Unauthenticated RCE
Rounding out the list is CVE-2026-34486 (CVSS 7.5), an EncryptInterceptor bypass in Apache Tomcat. This flaw, patched in April, was inadvertently introduced in March via a fix for a separate padding oracle issue ([CVE-2026-29146]). According to StrigaAI, which identified the bug, the fix caused the EncryptInterceptor — an optional channel interceptor used to encrypt messages between nodes in Tomcat clusters — to shift from a fail-closed to a fail-open state. This change created a direct path to unauthenticated remote code execution on every cluster member. While normally only messages encrypted with a shared key should be decrypted and processed, the bypass allowed attacker-controlled, unmodified code to be forwarded upon failed decryption. SOCRadar reported exploitation by a Chinese threat actor involving Snowlight malware, and Palo Alto Networks observed Chinese hackers leveraging it in an AI-enabled autonomous hacking campaign.
Actionable Recommendations and Mitigations
Organizations must treat these CISA warnings with the highest priority due to confirmed in-the-wild exploitation. Federal agencies are mandated to patch these vulnerabilities by August 7, in line with BOD 26-04 requirements, and all other organizations should follow this aggressive timeline.
- Prioritize Patching: Immediately apply the latest security updates for IBM Langflow OSS (version 1.10.1 or later), N-able N-central (hotfixes addressing CVE-2026-18556 and CVE-2026-18577), and Apache Tomcat (patches addressing CVE-2026-34486, released in April).
- Review Deployments: For Apache Tomcat, review configurations to ensure the EncryptInterceptor is correctly implemented or that affected clusters are updated.
- Monitor for Compromise: Actively monitor network traffic and system logs for any indicators of compromise related to these vulnerabilities, especially if patching cannot be performed immediately.
- Implement Least Privilege: Ensure that RMM platforms like N-able N-central are segmented and access is strictly controlled, limiting potential impact if an authentication bypass occurs.
These vulnerabilities present significant risks, and a proactive patching and monitoring strategy is essential to protect critical assets from active exploitation.
Related: CVE-2026-18556: N-able N-central Authentication Bypass Actively Exploited, Windows BlueHammer Flaw Exploited by Ransomware Gangs — Patch Now