CISA added IBM Langflow CVE-2026-9198, N-able N-central CVE-2026-18556, and Apache Tomcat CVE-2026-34486 to its Known Exploited Vulnerabilities catalog on August 4, with a August 7, 2026 remediation deadline recorded for federal civilian agencies. The immediate operational message for everyone else is the same: these are no longer patch-backlog candidates. They are three distinct paths into high-value administration, application, and cluster-management systems that CISA says have crossed its active-exploitation threshold.
The addition is independently reflected in the National Vulnerability Database records for all three CVEs, each now carrying CISA KEV status, an August 4 addition date, and the same August 7 due date. CISA’s announcement does not identify the threat actors, victims, exploitation volume, or the specific methods used against Langflow or Tomcat. That absence matters: a KEV listing confirms exploitation evidence met CISA’s standard; it does not establish that every affected deployment is broadly scanned or compromised.
For Windows administrators and MSPs, the N-central entry deserves first attention because a remote monitoring and management server is already trusted to reach customer endpoints. The Langflow flaw is the clearest direct code-execution exposure. The Tomcat issue is more specialized, but it can expose traffic inside a cluster precisely where teams may assume encryption is already doing its job.
CVE-2026-9198 affects IBM Langflow OSS versions 1.0.0 through 1.10.0, according to the CVE record maintained by NVD. The record describes a chain in which an unauthenticated network caller can obtain a superuser token through the
IBM assigned the issue a CVSS 3.1 score of 9.8. The score itself is unsurprising given the combination of network access, no required privileges, no user interaction, and complete confidentiality, integrity, and availability impact. The practical concern is where Langflow deployments sit: AI workflow and orchestration tooling often has access to model-provider keys, database credentials, API tokens, files, and connectors that are more valuable than the server’s own operating system account.
There is a versioning wrinkle worth resolving before a team closes this ticket. The NVD configuration lists versions below 1.10.1 as affected, which makes 1.10.1 the apparent first fixed release for CVE-2026-9198. IBM’s broader July security bulletin for Langflow, however, lists Langflow OSS 1.0.0 through 1.10.1 as affected by multiple unauthenticated and insufficiently authorized API issues and recommends upgrading to 1.10.2.
That is not a reason to delay; it is a reason to avoid treating a narrowly fixed build as the destination. Organizations that operate Langflow should move to IBM’s currently recommended 1.10.2 release, confirm the deployed version rather than relying on a container tag or package manifest, and rotate secrets reachable by the service if the instance was network-accessible before patching. IBM lists no workaround in the bulletin, so taking the application off public networks is the appropriate temporary control if an upgrade cannot be completed immediately.
The key inventory question is not whether the organization formally “uses AI.” It is whether developers, data teams, or line-of-business groups have deployed Langflow into Kubernetes, a cloud VM, Docker, or a Windows development environment with an externally reachable port. Shadow deployments are a credible concern here because the vulnerable behavior is tied to default application endpoints rather than a user-driven workflow.
The more consequential update is in CISA’s machine-readable vulnerability metadata. On August 4, CISA’s ADP record changed its assessment from exploitation “none,” not automatable, and partial technical impact to exploitation “yes,” automatable, and total technical impact. That change is more useful to defenders than a generic severity label: CISA is treating the flaw as a repeatable route to complete compromise, not merely an authentication defect with limited blast radius.
But the N-central case has a critical scope complication. N-able’s August 3 incident update says its investigation began after its Adlumin MDR service detected active exploitation in a customer environment on July 31. N-able says attackers remotely obtained administrative access to N-central servers, used the Take Control feature to connect to managed systems, and then registered a Cloudflare tunnel service for persistence on those downstream devices.
N-able also says the incident involved a newly issued CVE, CVE-2026-18577, which affected all N-central versions prior to Hotfix 2026.3.1.7. The company says that hotfix addresses both CVE-2026-18577 and CVE-2026-18556.
That creates a distinction administrators should not miss: the KEV entry added today is CVE-2026-18556, whose NVD record stops at 2026.1, while N-able’s active-incident response calls for 2026.3.1.7 because the related CVE-2026-18577 expanded the exposure to every earlier N-central release. Patching only to a version assumed to clear CVE-2026-18556 is not an adequate response to the incident N-able has described.
N-able says only a limited number of customers were identified as impacted and that it contacted those customers directly. That is vendor reporting, not an independently established victim count. It also means non-contacted organizations should not infer they are clean: N-able explicitly warns that its supplied detection template checks only currently known indicators and that a clean result does not prove the environment was untouched.
For N-central operators, the response has to treat the server as a potential control-plane breach. Apply or validate Hotfix 2026.3.1.7, review N-central administrative and authentication activity, inspect Take Control activity, and hunt managed Windows endpoints for unauthorized services and Cloudflare tunnel tooling. N-able published a set of source IP indicators, but IP matching should be only one part of that work; the company itself says its investigation remains ongoing.
The affected upstream releases are narrowly defined: Tomcat 9.0.116, 10.1.53, and 11.0.20. Apache’s specified fixed releases are 9.0.117, 10.1.54, and 11.0.21, respectively. NVD lists a 7.5 CVSS 3.1 score with no required privileges or user interaction and a high confidentiality impact.
The direct consequence is that organizations running a Tomcat cluster cannot assume that an
The exploitation designation should also prompt a more targeted review of network architecture. Cluster membership ports should not be routed broadly across internal networks, exposed through load balancers, or accessible from untrusted segments. Network isolation does not replace the update, but it reduces the number of systems capable of interacting with a cluster channel while patching is underway.
A defensible short-term response should include the following:
For Windows administrators and MSPs, the N-central entry deserves first attention because a remote monitoring and management server is already trusted to reach customer endpoints. The Langflow flaw is the clearest direct code-execution exposure. The Tomcat issue is more specialized, but it can expose traffic inside a cluster precisely where teams may assume encryption is already doing its job.
IBM Langflow CVE-2026-9198 is an unauthenticated code-execution chain
CVE-2026-9198 affects IBM Langflow OSS versions 1.0.0 through 1.10.0, according to the CVE record maintained by NVD. The record describes a chain in which an unauthenticated network caller can obtain a superuser token through the /api/v1/auto_login endpoint and then pass code to /api/v1/validate/code, which executes it through Python’s exec() function. In a default deployment, that is full remote code execution without credentials.IBM assigned the issue a CVSS 3.1 score of 9.8. The score itself is unsurprising given the combination of network access, no required privileges, no user interaction, and complete confidentiality, integrity, and availability impact. The practical concern is where Langflow deployments sit: AI workflow and orchestration tooling often has access to model-provider keys, database credentials, API tokens, files, and connectors that are more valuable than the server’s own operating system account.
There is a versioning wrinkle worth resolving before a team closes this ticket. The NVD configuration lists versions below 1.10.1 as affected, which makes 1.10.1 the apparent first fixed release for CVE-2026-9198. IBM’s broader July security bulletin for Langflow, however, lists Langflow OSS 1.0.0 through 1.10.1 as affected by multiple unauthenticated and insufficiently authorized API issues and recommends upgrading to 1.10.2.
That is not a reason to delay; it is a reason to avoid treating a narrowly fixed build as the destination. Organizations that operate Langflow should move to IBM’s currently recommended 1.10.2 release, confirm the deployed version rather than relying on a container tag or package manifest, and rotate secrets reachable by the service if the instance was network-accessible before patching. IBM lists no workaround in the bulletin, so taking the application off public networks is the appropriate temporary control if an upgrade cannot be completed immediately.
The key inventory question is not whether the organization formally “uses AI.” It is whether developers, data teams, or line-of-business groups have deployed Langflow into Kubernetes, a cloud VM, Docker, or a Windows development environment with an externally reachable port. Shadow deployments are a credible concern here because the vulnerable behavior is tied to default application endpoints rather than a user-driven workflow.
N-central’s CVE record is narrower than N-able’s incident response
CVE-2026-18556 is an authentication-bypass vulnerability in N-able N-central, the RMM platform widely used by managed service providers and internal IT teams. NVD records the affected product range as N-central through version 2026.1 and describes the weakness as an alternate-path or alternate-channel authentication bypass. N-able assigned a CVSS 4.0 score of 8.2, while NVD’s CVSS 3.1 assessment is 7.4.The more consequential update is in CISA’s machine-readable vulnerability metadata. On August 4, CISA’s ADP record changed its assessment from exploitation “none,” not automatable, and partial technical impact to exploitation “yes,” automatable, and total technical impact. That change is more useful to defenders than a generic severity label: CISA is treating the flaw as a repeatable route to complete compromise, not merely an authentication defect with limited blast radius.
But the N-central case has a critical scope complication. N-able’s August 3 incident update says its investigation began after its Adlumin MDR service detected active exploitation in a customer environment on July 31. N-able says attackers remotely obtained administrative access to N-central servers, used the Take Control feature to connect to managed systems, and then registered a Cloudflare tunnel service for persistence on those downstream devices.
N-able also says the incident involved a newly issued CVE, CVE-2026-18577, which affected all N-central versions prior to Hotfix 2026.3.1.7. The company says that hotfix addresses both CVE-2026-18577 and CVE-2026-18556.
That creates a distinction administrators should not miss: the KEV entry added today is CVE-2026-18556, whose NVD record stops at 2026.1, while N-able’s active-incident response calls for 2026.3.1.7 because the related CVE-2026-18577 expanded the exposure to every earlier N-central release. Patching only to a version assumed to clear CVE-2026-18556 is not an adequate response to the incident N-able has described.
N-able says only a limited number of customers were identified as impacted and that it contacted those customers directly. That is vendor reporting, not an independently established victim count. It also means non-contacted organizations should not infer they are clean: N-able explicitly warns that its supplied detection template checks only currently known indicators and that a clean result does not prove the environment was untouched.
For N-central operators, the response has to treat the server as a potential control-plane breach. Apply or validate Hotfix 2026.3.1.7, review N-central administrative and authentication activity, inspect Take Control activity, and hunt managed Windows endpoints for unauthorized services and Cloudflare tunnel tooling. N-able published a set of source IP indicators, but IP matching should be only one part of that work; the company itself says its investigation remains ongoing.
Apache Tomcat CVE-2026-34486 is a cluster-encryption regression
CVE-2026-34486 is not a generic “patch every Tomcat server because it has an HTTP listener” event. It concerns Apache Tomcat’s Tribes clustering component and theEncryptInterceptor, which is intended to protect cluster traffic. Apache’s CVE description says a fix for CVE-2026-29146 introduced a way to bypass that interceptor entirely, allowing sensitive cluster data to travel without the expected encryption.The affected upstream releases are narrowly defined: Tomcat 9.0.116, 10.1.53, and 11.0.20. Apache’s specified fixed releases are 9.0.117, 10.1.54, and 11.0.21, respectively. NVD lists a 7.5 CVSS 3.1 score with no required privileges or user interaction and a high confidentiality impact.
The direct consequence is that organizations running a Tomcat cluster cannot assume that an
EncryptInterceptor configuration remained effective merely because it existed in server.xml. A bad fix for the earlier flaw created a regression in the exact release line that was meant to improve cluster-channel security. Teams should identify active Tribes clusters, check their actual package versions—including vendor-maintained Tomcat packages rather than only upstream tarballs—and verify post-update cluster encryption behavior.The exploitation designation should also prompt a more targeted review of network architecture. Cluster membership ports should not be routed broadly across internal networks, exposed through load balancers, or accessible from untrusted segments. Network isolation does not replace the update, but it reduces the number of systems capable of interacting with a cluster channel while patching is underway.
The August 7 deadline is a triage marker, not a three-day maintenance window
CISA’s Binding Operational Directive 26-04 applies directly to Federal Civilian Executive Branch agencies, but CISA’s KEV dates are useful urgency signals for every organization. The August 7 deadline gives federal agencies three calendar days from the August 4 addition. For private-sector teams, it should trigger the same immediate actions: establish exposure, apply the vendor’s current remediation, and determine whether exploitation occurred before the change.A defensible short-term response should include the following:
- Inventory Langflow OSS, N-central, and Tomcat installations by actual version and deployment location, including cloud instances, containers, lab environments, and customer-management infrastructure.
- Upgrade Langflow to IBM’s current recommended 1.10.2 release and rotate credentials that an exposed instance could have accessed.
- Bring N-central to 2026.3.1.7 rather than stopping at a version that only appears to address CVE-2026-18556, then conduct incident review across the N-central server and managed endpoints.
- Upgrade affected Tomcat builds to 9.0.117, 10.1.54, or 11.0.21 and verify that clustered deployments are again encrypting their inter-node traffic as intended.
- Preserve and review logs before they roll over, especially N-central authentication, administrator, remote-control, service-installation, and outbound-connection records.
References
- Primary source: CISA
Published: 2026-08-04T12:00:00+00:00
Loading…
www.cisa.gov - Related coverage: nvd.nist.gov
Loading…
nvd.nist.gov - Related coverage: linux.oracle.com
Loading…
linux.oracle.com - Related coverage: cdn.nca.gov.sa
Loading…
cdn.nca.gov.sa - Related coverage: cyber.gc.ca
Loading…
www.cyber.gc.ca - Related coverage: catalog.data.gov
Loading…
catalog.data.gov - Related coverage: cdn.nca.gov.sa
Loading…
cdn.nca.gov.sa - Related coverage: advisories.ncsc.nl
Loading…
advisories.ncsc.nl - Related coverage: nvd.nist.gov
Loading…
nvd.nist.gov - Related coverage: vulnerabilities.etecs.ru
Loading…
vulnerabilities.etecs.ru - Related coverage: pentest-tools.com
Loading…
pentest-tools.com - Related coverage: cvedatabase.com
Loading…
cvedatabase.com - Related coverage: cyber.trackr.live
Loading…
cyber.trackr.live - Related coverage: senserva.com
Loading…
senserva.com