cyber.hendryadrian.com
Security News · bleepingcomputer.com

CISA Orders Agencies to Mitigate Actively Exploited Flaws in Langflow, N-central and Tomcat

· Original article ↗

Summary

CISA gave federal agencies three days to mitigate actively exploited flaws in IBM Langflow, N-central and Apache Tomcat. It added the vulnerabilities to its KEV catalog; ransomware use is unknown.

Key points

  • CISA confirmed threat actors are exploiting all three flaws and added them to its Known Exploited Vulnerabilities catalog.
  • IBM Langflow CVE-2026-9198 enables unauthenticated remote code execution in default deployments; public proof-of-concept exploits are available.
  • N-able N-central CVE-2026-18576 can enable unauthenticated administrative account hijacking. After an earlier fix proved insufficient, N-able released an emergency hotfix; versions before 2026.3 were affected.
  • Apache Tomcat CVE-2026-34486 was used in a manual campaign to plant reverse shells on nine servers, according to Palo Alto Networks Unit 42.
  • CISA ordered federal agencies to apply available mitigations within three days. The agency said it is unknown whether the flaws are being used in ransomware campaigns.

Article Details

Event Type
CISA warning and mitigation order for actively exploited vulnerabilities in IBM Langflow, N-central, and Apache Tomcat.
Impact
The flaws enable unauthenticated remote code execution in Langflow, administrative account hijacking in N-central, and reverse-shell deployment on Apache Tomcat servers. CISA said all three vulnerabilities were being exploited and gave federal agencies three days to apply available mitigations. N-able released an emergency hotfix for N-central; the article does not establish whether the vulnerabilities are being used in ransomware campaigns.

CVE

CVE-2026-0770#IBMLangflowCVE-2026-18576#IBMLangflowCVE-2026-29146It stems from an incomplete fix for CVE-2026-29146, a critical vulnerability with a severity rating of 9.8 that is described as the missing encryption of sensitive data.CVE-2026-34486#IBMLangflowCVE-2026-9198#IBMLangflow

Vendors

IBMCISA has ordered federal agencies to quickly mitigate actively exploited vulnerabilities in IBM Langflow, N-central, and Apache Tomcat.N-ableN-able’s N-central flaw CVE-2026-18576 can let attackers hijack administrative accounts without authentication.

Products

Apache TomcatCISA has ordered federal agencies to quickly mitigate actively exploited vulnerabilities in IBM Langflow, N-central, and Apache Tomcat.LangflowCISA has ordered federal agencies to quickly mitigate actively exploited vulnerabilities in IBM Langflow, N-central, and Apache Tomcat.N-centralCISA has ordered federal agencies to quickly mitigate actively exploited vulnerabilities in IBM Langflow, N-central, and Apache Tomcat.

Related Articles