Vulnerabilities in IBM Langflow, N-central, and Apache Tomcat
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning to federal agencies regarding the exploitation of vulnerabilities in IBM Langflow, N-central, and Apache Tomcat. The agency has given federal agencies three days to mitigate these vulnerabilities, which are being actively exploited by hackers.
CVE-2026-9198: A Critical Vulnerability in IBM Langflow
Tracked as CVE-2026-9198, the security issue in IBM's Langflow visual framework for building AI agents has a critical rating of 9.8 out of 10. This vulnerability allows an unauthenticated attacker to execute code remotely on default Langflow deployments by chaining two API endpoints to bypass login and run code. In late July, multiple fully functional proof-of-concept (PoC) exploits for CVE-2026-9198 emerged in the public space, with complete instructions on how they can be leveraged.
Two weeks ago, CISA issued an alert for another critical Langflow vulnerability (CVE-2026-0770) being exploited in attacks to gain remote code execution with root privileges. This vulnerability highlights the importance of keeping software up to date and patched to prevent exploitation by threat actors.
CVE-2026-18576: A Vulnerability in N-central
The vulnerability in N-able's remote monitoring and management platform N-central is identified as CVE-2026-18576. This flaw allows attackers to hijack administrative accounts without authentication and has been patched by the vendor. However, the fix was insufficient, and threat actors found a new way to exploit it. N-able warned customers on August 1st that hackers were actively exploiting the new vulnerability, which received the identifier CVE-2026-18576.
An emergency hotfix was released on Sunday, and the company urged customers to install it as the flaw impacted all versions of N-central before 2026.3. This vulnerability highlights the importance of keeping software up to date and patched to prevent exploitation by threat actors.
CVE-2026-34486: A Vulnerability in Apache Tomcat
The Apache Tomcat vulnerability, tracked as CVE-2026-34486, has a high-severity score of 7.5. It stems from an incomplete fix for CVE-2026-29146, a critical vulnerability with a severity rating of 9.8 that is described as the missing encryption of sensitive data. On July 30, researchers at Palo Alto Networks Unit 42 reported that a Chinese-speaking threat actor tried to exploit the CVE-2026-34486 vulnerability in a manual campaign to plant reverse shells on nine Apache Tomcat servers.
CISA confirmed that threat actors are leveraging all three flaws in attacks and added them to its catalog of Known Exploited Vulnerabilities (KEV). However, the agency did not share what types of attacks are leveraging them, noting that it is unknown if they are used in ransomware campaigns. CISA has ordered federal agencies to apply available mitigations for the three targeted products by the end of Friday, August 7th.
Conclusion
The exploitation of vulnerabilities in IBM Langflow, N-central, and Apache Tomcat by hackers highlights the importance of keeping software up to date and patched to prevent exploitation by threat actors. It is essential for organizations to prioritize cybersecurity and take proactive measures to protect themselves from potential threats.
Security teams should log and alert on all successful attacks, and breach and attack simulation tests should be conducted to ensure that threats are detected and prevented. The Picus whitepaper shows how breach and attack simulation tests can be used to test SIEM and EDR rules, preventing threats from slipping by detection.
Source: BleepingComputer