[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fE0aDoyWm52SfBYJPeHBPZpPrPUxHN4b-6vTFEl44HzA":3},{"article":4,"iocs":53},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":32,"category":33,"article_tags":37},"441e951e-15bc-4164-9327-de1c1acf65de","CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws","cisa-warns-of-hackers-exploiting-langflow-n-central-apache-tomcat-flaws-4dcce5","The U.S. Cybersecurity and Infrastructure Security Agency is giving federal agencies three days to mitigate vulnerabilities in IBM Langflow, N-central, and Apache Tomcat, all actively exploited. [...]","CISA has issued an urgent directive requiring federal agencies to mitigate three actively exploited vulnerabilities: CVE-2026-9198 in IBM Langflow (CVSS 9.8, unauthenticated RCE), CVE-2026-18576 in N-able's N-central (authentication bypass), and CVE-2026-34486 in Apache Tomcat (CVSS 7.5, data encryption flaw). Public PoC exploits for Langflow and active threat actor campaigns against Tomcat servers have been documented, prompting CISA to add all three to its Known Exploited Vulnerabilities catalog with a three-day remediation deadline for federal agencies.","CISA orders federal agencies to patch actively exploited flaws in Langflow, N-central, and Apache Tomcat within three","CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws By Ionut Ilascu August 5, 2026 11:51 AM 0 The U.S. Cybersecurity and Infrastructure Security Agency is giving federal agencies three days to mitigate vulnerabilities in IBM Langflow, N-central, and Apache Tomcat, all actively exploited. ​Tracked as CVE-2026-9198, the security issue in IBM’s Langflow visual framework for building AI agents is the most severe, with a critical rating of 9.8 out of 10. It allows an unauthenticated attacker to execute remotely on default Langflow deployments by chaining two API endpoints to bypass login and run code. In late July, multiple fully functional proof-of-concept (PoC) exploits for CVE-2026-9198 emerged in the public space, with complete instructions on how they can be leveraged. Two weeks ago, CISA issued an alert for another critical Langflow vulnerability (CVE-2026-0770) being exploited in attacks to gain remote code execution with root privileges. The vulnerability in N-able’s remote monitoring and management platform N-central is identified as CVE-2026-18576 and allows attackers to hijack administrative accounts without authentication. The flaw received a high-severity rating and has been patched by the vendor. However, the fix was insufficient, and threat actors found a new way to exploit it. N-able warned customers on August 1st that hackers were actively exploiting the new vulnerability, which received the identifier CVE-2026-18576. An emergency hotfix was released on Sunday. The company urged customers to install it as the flaw impacted all versions of N-central before 2026.3. The Apache Tomcat vulnerability, tracked as CVE-2026-34486, has a high-severity score of 7.5. It stems from an incomplete fix for CVE-2026-29146, a critical vulnerability with a severity rating of 9.8 that is described as the missing encryption of sensitive data. On July 30, researchers at Palo Alto Networks Unit 42 reported that a Chinese-speaking threat actor tried to exploit the CVE-2026-34486 vulnerability in a manual campaign to plant reverse shells on nine Apache Tomcat servers. CISA confirmed that threat actors are leveraging all three flaws in attacks and added them to its catalog of Known Exploited Vulnerabilities (KEV). However, the agency did not share what types of attacks are leveraging them, noting that it is unknown if they are used in ransomware campaigns. CISA has ordered federal agencies to apply available mitigations for the three targeted products by the end of Friday, July 7th. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: CISA orders urgent action on actively exploited Langflow RCE flawCritical Langflow RCE flaw exploited to hack AI app serversCISA: Microsoft SharePoint RCE flaw now actively exploitedCISA sets urgent deadline to fix Cisco flaw exploited in attacksCISA orders feds to patch max severity Joomla plugin flaw by Friday","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisa-warns-of-hackers-exploiting-langflow-n-central-apache-tomcat-flaws\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F01\u002F13\u002FCISA_headpic.jpg","2026-08-05T15:51:33+00:00","2026-08-05T16:00:07.956781+00:00",9,[18,21,24,26,28,30],{"name":19,"type":20},"IBM","vendor",{"name":22,"type":23},"Langflow","product",{"name":25,"type":20},"N-able",{"name":27,"type":23},"N-central",{"name":29,"type":20},"Apache",{"name":31,"type":23},"Apache Tomcat","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61,64,67],{"type":55,"value":56,"context":57},"cve","CVE-2026-9198","Critical RCE in IBM Langflow (CVSS 9.8); unauthenticated API endpoint chaining allows remote code execution on default deployments; public PoC available",{"type":55,"value":59,"context":60},"CVE-2026-0770","Critical Langflow vulnerability exploited to gain remote code execution with root privileges",{"type":55,"value":62,"context":63},"CVE-2026-18576","High-severity authentication bypass in N-able N-central; allows unauthenticated administrative account hijacking; actively exploited; incomplete patch required emergency hotfix",{"type":55,"value":65,"context":66},"CVE-2026-34486","High-severity Tomcat RCE (CVSS 7.5); incomplete fix for CVE-2026-29146; Chinese-speaking threat actor exploited in manual campaign targeting nine servers",{"type":55,"value":68,"context":69},"CVE-2026-29146","Critical Tomcat vulnerability (CVSS 9.8); missing encryption of sensitive data; incomplete fix led to CVE-2026-34486"]