# CISA Warns: Actively Exploited Langflow, N-central, and Tomcat Vulnerabilities

> CISA warns federal agencies and organizations about active exploitation of critical vulnerabilities in IBM Langflow, N-able N-central, and Apache Tomcat.

- Published: 2026-08-05T10:27:25.000Z
- Severity: critical
- Category: Vulnerabilities
- Tags: CISA KEV, CVE-2026-9198, CVE-2026-18556, CVE-2026-18577, CVE-2026-34486
- CVEs: CVE-2026-9198 (CVSS 9.8), CVE-2026-18556 (CVSS 7.4), CVE-2026-34486 (CVSS 7.5)
- Author: Runtime Rebel Intel
- Primary source: https://www.securityweek.com/cisa-warns-of-exploited-langflow-n-central-and-tomcat-vulnerabilities/
- Canonical: https://runtimerebel.com/blog/cisa-warns-actively-exploited-langflow-n-central-and-tomcat-vulnerabilities

## Key points

- Threat actors are actively exploiting critical flaws in IBM Langflow, N-able N-central, and Apache Tomcat.
- Affected systems include IBM Langflow OSS, N-able N-central, and Apache Tomcat deployments with EncryptInterceptor.
- Prioritize immediate patching of all listed vulnerabilities, especially those in CISA's KEV catalog.

The U.S. [Cybersecurity and Infrastructure Security Agency (CISA)](/glossary#cybersecurity-and-infrastructure-security-agency-cisa) has issued a critical warning regarding three actively exploited vulnerabilities impacting IBM Langflow OSS, N-able N-central, and Apache Tomcat. Threat actors are leveraging these flaws for remote code execution ([RCE](/glossary#rce)) and authentication bypass, prompting CISA to add all three to its Known Exploited Vulnerabilities ([KEV](/glossary#kev)) catalog. This advisory underscores the immediate and severe risk these vulnerabilities pose to organizations utilizing the affected software, urging rapid remediation according to [SecurityWeek](https://www.securityweek.com/cisa-warns-of-exploited-langflow-n-central-and-tomcat-vulnerabilities/).

## Technical Analysis of Exploited Vulnerabilities

### IBM Langflow OSS Remote Code Execution ([CVE](/glossary#cve)-2026-9198)

CISA has flagged [CVE-2026-9198](/cve/cve-2026-9198), an unauthenticated remote code execution [vulnerability](/glossary#vulnerability) in IBM Langflow OSS. With a [CVSS](/glossary#cvss) score of 9.8, this critical flaw allows attackers to chain two distinct [API](/glossary#api) endpoints. Specifically, an unauthenticated [endpoint](/glossary#endpoint) issues superuser bearer tokens to any network caller, which can then be used with a code validation endpoint to execute arbitrary Python code. IBM disclosed and patched this vulnerability in Langflow OSS version 1.10.1 on July 17, warning that all default deployments were affected. Proof-of-concept (PoC) code was publicly released approximately a week after disclosure, highlighting the urgency for organizations to understand how attackers [exploit](/glossary#exploit) Langflow OSS RCE CVE-2026-9198 and apply patches without delay.

### N-able N-central Authentication Bypass (CVE-2026-18556 & CVE-2026-18577)

The N-able N-central [remote monitoring and management (RMM)](/glossary#remote-monitoring-and-management-rmm) platform is impacted by two related vulnerabilities now in CISA's KEV catalog. The primary issue, [CVE-2026-18556](/cve/cve-2026-18556) (CVSS 7.4), is an authentication bypass that threat actors exploited as a [zero-day](/glossary#zero-day) to gain administrative access to systems managed via the platform. N-able initially released a fix, but exploitation activity intensified by the end of July as threat actors bypassed this initial [patch](/glossary#patch). This led to the issuance of [CVE-2026-18577](/cve/cve-2026-18577), which addresses the patch bypass. The confirmed zero-day exploitation and subsequent bypass demonstrate a persistent threat, emphasizing the need for immediate attention to N-able N-central authentication bypass CVE-2026-18556 mitigation strategies.

### Addressing Apache Tomcat CVE-2026-34486 Unauthenticated RCE

Rounding out the list is [CVE-2026-34486](/cve/cve-2026-34486) (CVSS 7.5), an EncryptInterceptor bypass in Apache Tomcat. This flaw, patched in April, was inadvertently introduced in March via a fix for a separate padding oracle issue ([CVE-2026-29146]). According to StrigaAI, which identified the bug, the fix caused the EncryptInterceptor — an optional channel interceptor used to encrypt messages between nodes in Tomcat clusters — to shift from a fail-closed to a fail-open state. This change created a direct path to unauthenticated remote code execution on every cluster member. While normally only messages encrypted with a shared key should be decrypted and processed, the bypass allowed attacker-controlled, unmodified code to be forwarded upon failed decryption. SOCRadar reported exploitation by a Chinese [threat actor](/glossary#threat-actor) involving Snowlight [malware](/glossary#malware), and Palo Alto Networks observed Chinese hackers leveraging it in an [AI](/glossary#ai)-enabled autonomous hacking campaign.

## Actionable Recommendations and Mitigations

Organizations must treat these CISA warnings with the highest priority due to confirmed in-the-wild exploitation. Federal agencies are mandated to patch these vulnerabilities by August 7, in line with BOD 26-04 requirements, and all other organizations should follow this aggressive timeline.

*   **Prioritize Patching:** Immediately apply the latest security updates for IBM Langflow OSS (version 1.10.1 or later), N-able N-central (hotfixes addressing CVE-2026-18556 and CVE-2026-18577), and Apache Tomcat (patches addressing CVE-2026-34486, released in April).
*   **Review Deployments:** For Apache Tomcat, review configurations to ensure the EncryptInterceptor is correctly implemented or that affected clusters are updated.
*   **Monitor for Compromise:** Actively monitor network traffic and system logs for any indicators of compromise related to these vulnerabilities, especially if patching cannot be performed immediately.
*   **Implement [Least Privilege](/glossary#least-privilege):** Ensure that RMM platforms like N-able N-central are segmented and access is strictly controlled, limiting potential impact if an authentication bypass occurs.

These vulnerabilities present significant risks, and a proactive patching and monitoring strategy is essential to protect critical assets from active exploitation.

**Related:** [CVE-2026-18556: N-able N-central Authentication Bypass Actively Exploited](/blog/cve-2026-18556-n-able-n-central-authentication-bypass-actively-exploited), [Windows BlueHammer Flaw Exploited by Ransomware Gangs — Patch Now](/blog/windows-bluehammer-flaw-exploited-by-ransomware-gangs-patch-now)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cisa-warns-actively-exploited-langflow-n-central-and-tomcat-vulnerabilities