CISA ADDS THREE ACTIVELY EXPLOITED IBM LANGFLOW, N-ABLE N-CENTRAL AND APACHE TOMCAT VULNERABILITIES TO KNOWN EXPLOITED VULNERABILITIES CATALOG

THREAT SUMMARY

Category: Active Exploitation / Code Injection / Authentication Bypass / Sensitive-Data Exposure / Application Security / Remote Management Security
Affected Products: IBM Langflow, N-able N-central, Apache Tomcat
CVEs: CVE-2026-9198, CVE-2026-18556, CVE-2026-34486
Primary Risks: Unauthorized Code Execution, Authentication-Control Bypass, Administrative Compromise, Sensitive-Data Exposure, Credential Theft, Application Compromise, Endpoint Manipulation, Persistent Access and Lateral Movement
Threat Status: Confirmed Active Exploitation
Affected Environment: Federal Agencies, Managed Service Providers, Enterprise Networks, Software Developers, Cloud Environments, Critical Infrastructure and Organizations Operating the Affected Products
Attack Vectors: Code Injection, Authentication Bypass Using an Alternate Path or Channel, Missing Encryption of Sensitive Data
CISA Action: Added to Known Exploited Vulnerabilities Catalog
Required Response: Identify affected deployments, apply available remediation, reduce unnecessary exposure and inspect systems for evidence of compromise

---

The Cybersecurity and Infrastructure Security Agency has added three vulnerabilities affecting IBM Langflow, N-able N-central and Apache Tomcat to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation.

CISA announced the additions on August 4, 2026. The agency warned that these vulnerability classes are frequently used by malicious cyber actors and pose significant risks to the federal enterprise.

The vulnerabilities are tracked as CVE-2026-9198, an IBM Langflow code-injection vulnerability; CVE-2026-18556, an N-able N-central authentication-bypass vulnerability; and CVE-2026-34486, an Apache Tomcat missing-encryption vulnerability involving sensitive data.

Their inclusion in the KEV Catalog confirms that CISA has evidence of active exploitation involving each vulnerability. This CISA alert does not identify the responsible threat actors, name affected organizations or state that the three vulnerabilities are being used as part of the same intrusion campaign.

The products serve different functions and create separate areas of risk. IBM Langflow supports the development and orchestration of artificial-intelligence workflows. N-able N-central provides centralized remote monitoring and management capabilities. Apache Tomcat operates as a widely used application server and servlet container for Java-based services.

CVE-2026-9198 — IBM Langflow

Vulnerability: Code Injection

CVE-2026-9198 is a code-injection vulnerability affecting IBM Langflow.

Code injection occurs when an application accepts attacker-controlled input and processes it as executable code or commands without sufficient validation or restriction. Successful exploitation can allow an attacker to make the affected system perform unauthorized actions.

The operational consequences will depend on the vulnerable Langflow component, the privileges assigned to the service and its connections to other resources. A successful attacker could potentially execute unauthorized code, access application data, manipulate workflows or use the compromised environment to reach connected services.

Langflow deployments may interact with artificial-intelligence models, application programming interfaces, databases, cloud resources and automation tools. Credentials or access tokens used by those connections could become targets after an attacker gains control of the affected environment.

A compromised workflow platform could also allow unauthorized modification of application logic or data-processing instructions. Changes made inside an automated workflow may be difficult to identify if the attacker preserves normal application behavior while redirecting information or introducing hidden functions.

CVE-2026-18556 — N-able N-central

Vulnerability: Authentication Bypass Using an Alternate Path or Channel

CVE-2026-18556 is an authentication-bypass vulnerability affecting N-able N-central.

N-central is a remote monitoring and management platform used by organizations and managed service providers to administer systems, deploy software, monitor security conditions and maintain endpoints across customer environments.

An authentication bypass can allow an attacker to reach protected functionality without completing the intended login process. An alternate path or channel may provide access that does not enforce the same security controls as the primary authentication mechanism.

Successful exploitation could expose administrative functions or allow unauthorized activity within the N-central environment. The extent of the damage would depend on the privileges obtained, the system configuration and the number of connected endpoints.

A compromised remote monitoring and management platform presents serious risks because it may hold trusted administrative access to numerous systems. Attackers could attempt to manipulate endpoint configurations, deploy unauthorized software, obtain credentials, create accounts or interfere with security controls.

Managed service providers face an additional risk because one centralized platform may provide access to multiple customer environments. A successful intrusion could expand from the provider’s infrastructure into organizations relying on that provider for remote administration and technical support.

CVE-2026-34486 — Apache Tomcat

Vulnerability: Missing Encryption of Sensitive Data

CVE-2026-34486 is a missing-encryption vulnerability affecting Apache Tomcat.

Missing encryption can expose sensitive information when an application stores, processes or transfers protected data without sufficient cryptographic safeguards. The exact risk depends on where the information is exposed, the privileges required to reach it and the type of data handled by the affected application.

Apache Tomcat supports Java-based web applications and services across government, corporate, healthcare, financial, educational and technology environments. A vulnerable deployment could expose information processed by the application server or provide attackers with data useful for additional intrusion activity.

Potentially exposed information could include credentials, session material, configuration information, application data or other sensitive records available through the affected component. The categories of information at risk will differ across deployments.

Sensitive information does not need to provide immediate control of a Tomcat server to create a serious security threat. Exposed credentials or session material could support account compromise, impersonation, access to connected applications or movement into other systems.

---

Operational Impact

Organizations operating affected systems could face:

• Unauthorized code execution
• IBM Langflow application compromise
• Manipulation of artificial-intelligence workflows
• Theft of application programming interface keys and access tokens
• Unauthorized access to connected databases or cloud services
• Bypass of N-central authentication controls
• Compromise of remote monitoring and management infrastructure
• Unauthorized administrative activity
• Endpoint manipulation
• Deployment of unauthorized software
• Creation of unauthorized accounts
• Credential and authentication-token exposure
• Compromise of managed customer environments
• Loss of confidentiality for sensitive Tomcat application data
• Exposure of session material or configuration information
• Unauthorized access to Java-based applications
• Security-control disruption
• Loss of system integrity
• Service interruption
• Movement into connected systems
• Persistent attacker access
• Data theft
• Reduced visibility into administrative activity
• Software supply-chain or managed-service-provider exposure
• Business and operational disruption

The extent of the damage will depend on the affected product, the system’s network exposure, the privileges available through the vulnerable component and the number of connected services or endpoints.

---

Federal Response

CISA added CVE-2026-9198, CVE-2026-18556 and CVE-2026-34486 to the Known Exploited Vulnerabilities Catalog under Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk.

BOD 26-04 establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies. The directive requires agencies to prioritize rapid remediation of high-risk vulnerabilities listed in the KEV Catalog.

The directive places particular emphasis on KEV vulnerabilities affecting publicly exposed assets when successful exploitation can provide total control of the affected system. It also establishes basic expectations for determining whether attackers compromised a system before updates or mitigations were applied.

Federal agencies must identify affected IBM Langflow, N-able N-central and Apache Tomcat deployments, determine which systems are publicly accessible and evaluate the operational importance of each asset.

Agencies must apply required remediation and conduct compromise assessments when required by CISA. Installing a security update does not remove unauthorized accounts, altered configurations, stolen credentials, exposed information or other persistence established before remediation.

Lower-risk vulnerabilities may receive deferred treatment under the directive, allowing federal agencies to direct resources toward actively exploited weaknesses presenting the greatest immediate danger.

BOD 26-04 applies directly to Federal Civilian Executive Branch agencies. CISA encourages private companies, critical infrastructure operators, managed service providers, software developers, educational institutions, healthcare organizations, financial institutions and state and local governments to adopt the same risk-based approach.

---

KEV Catalog Requirements

CISA continues adding vulnerabilities to the Known Exploited Vulnerabilities Catalog as reliable evidence of active exploitation becomes available.

A vulnerability considered for inclusion must have an assigned Common Vulnerabilities and Exposures identifier, evidence that malicious actors have exploited it and clear mitigation guidance.

Inclusion does not identify the number of compromised organizations or establish that every vulnerable deployment has been attacked. It confirms that exploitation has occurred and that affected organizations should prioritize corrective action.

Government agencies, software providers, security researchers and cybersecurity professionals can nominate vulnerabilities for consideration when the required evidence and mitigation information are available.

---

Defensive Guidance

Organizations operating affected products should:

• Identify every IBM Langflow deployment within the organization.
• Identify every N-able N-central deployment.
• Identify every Apache Tomcat server and associated application.
• Document installed versions, configurations and network locations.
• Determine which affected services are exposed to the internet or other untrusted networks.
• Apply available vendor security updates and CISA-required mitigations.
• Prioritize remediation according to KEV requirements.
• Remove unnecessary public exposure from administrative and management interfaces.
• Restrict administrative access to trusted networks and authorized personnel.
• Preserve application, authentication, administrative and network records before remediation.
• Review historical activity for evidence of exploitation.
• Examine Langflow systems for unauthorized code, workflow changes and unexpected connections.
• Review credentials, tokens and application programming interface keys accessible to Langflow.
• Inspect N-central for unfamiliar logins, sessions, accounts and privilege changes.
• Review N-central software-deployment and endpoint-management activity.
• Search managed systems for unauthorized packages, scripts or configuration changes.
• Examine Apache Tomcat records for suspicious requests and abnormal access activity.
• Determine what sensitive information was accessible through vulnerable Tomcat components.
• Review affected applications for exposed credentials, session material and configuration data.
• Revoke or rotate credentials, tokens, keys and secrets suspected of exposure.
• Terminate unauthorized or unexplained active sessions.
• Search connected systems for evidence of lateral movement.
• Inspect affected servers for unexpected files, processes, services and scheduled tasks.
• Verify that application, endpoint and security configurations remain intact.
• Isolate affected systems when immediate remediation cannot be completed.
• Confirm remediation across production, development, testing, backup and recovery environments.
• Require managed service providers to report remediation and investigative findings.
• Preserve relevant evidence for forensic examination.
• Continue monitoring after remediation for persistent attacker activity.
• Discontinue use of affected products if effective mitigation is unavailable.

Organizations should not assume that installing updates proves the systems were not compromised before remediation. Affected deployments must be examined for unauthorized activity, exposed information and persistence created while the vulnerabilities remained exploitable.

---

Forecast — 30 Days

• Accelerated scanning for exposed IBM Langflow, N-able N-central and Apache Tomcat deployments
• Continued exploitation of systems that remain unpatched or improperly mitigated
• Increased targeting of artificial-intelligence development and workflow environments
• Expanded attacks against managed service providers operating centralized N-central platforms
• Attempts to reach customer environments through compromised remote-management infrastructure
• Additional efforts to obtain credentials, tokens and application secrets from vulnerable systems
• Greater examination of historical application and administrative activity for evidence of compromise
• Increased credential rotation and active-session revocation
• Publication of additional technical details and defensive guidance for the three vulnerabilities
• Possible release of indicators of compromise as investigations develop
• Increased incorporation of the vulnerabilities into automated scanning and exploitation activity
• Accelerated remediation across federal agencies and critical infrastructure environments
• Continued attention to software platforms occupying trusted positions within enterprise networks
• Additional additions to CISA’s KEV Catalog as new exploitation evidence is confirmed

---

TRJ Verdict

The addition of CVE-2026-9198, CVE-2026-18556 and CVE-2026-34486 confirms active attacks against three different areas of enterprise technology: artificial-intelligence workflow development, centralized remote administration and Java-based application hosting.

Each vulnerability presents a distinct threat. IBM Langflow could provide attackers with a path to execute unauthorized code and access connected resources. N-able N-central could expose centralized administrative control over endpoints and managed customer environments. Apache Tomcat could expose sensitive information capable of supporting additional compromise.

Organizations should treat this KEV update as an immediate security event. Applying available remediation is necessary, but systems exposed before remediation must also be examined for unauthorized access, altered configurations, stolen credentials, exposed information and persistent attacker activity.

The most serious danger comes from the trusted position these products can occupy. A successful compromise may extend beyond the vulnerable application and reach connected services, managed endpoints, customer networks or other protected systems.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---