cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

CISA Warns of Exploitation Targeting Langflow, N-central and Tomcat Flaws

· Original article ↗

Summary

CISA warns that attackers are exploiting flaws in Langflow OSS, N-able N-central and Apache Tomcat. The article details the vulnerabilities and fixes, reports of Tomcat attacks, and CISA’s August 7 patch deadline for federal agencies.

Key points

  • CISA added CVE-2026-9198, CVE-2026-18556 and CVE-2026-34486 to its Known Exploited Vulnerabilities catalog.
  • CVE-2026-9198 allows unauthenticated remote code execution in Langflow OSS by chaining an endpoint that issues superuser tokens with one that executes Python code. IBM released a patch in version 1.10.1.
  • N-able said attackers exploited CVE-2026-18556, an authentication bypass, as a zero-day to gain administrative access and connect to systems managed through N-central.
  • The initial fix for CVE-2026-18556 was bypassed; N-able issued CVE-2026-18577 for the patch bypass, and both vulnerabilities are in CISA’s KEV catalog.
  • CVE-2026-34486 bypasses Apache Tomcat’s EncryptInterceptor. StrigaAI said a fail-open change could allow unauthenticated remote code execution on cluster members when the interceptor is configured.
  • SOCRadar and Palo Alto Networks reported exploitation of the Tomcat flaw, including attacks attributed to a Chinese threat actor and a campaign involving Snowlight malware.
  • CISA urged federal agencies to patch all three vulnerabilities by August 7.

Article Details

Vulnerability Types
  • Unauthenticated remote code execution
  • Authentication bypass
  • EncryptInterceptor decryption bypass
Severity
CVE-2026-9198: CVSS 9.8; CVE-2026-18556: CVSS 7.4; CVE-2026-34486: CVSS 7.5. No scores stated for CVE-2026-18577 or CVE-2026-29146.
Exploitation Status
active
Exploit Availability
public_poc
Patch Status
available

MITRE ATT&CK

T1059.006 · PythonThe Langflow OSS vulnerability allows attackers to submit malicious Python code to an endpoint that executes it.

CVE

CVE-2026-18556The N-able N-central bug flagged as exploited is tracked as CVE-2026-18556 (CVSS score of 7.4) and described as an authentication bypass.CVE-2026-18577As the exploitation activity intensified at the end of July, N-able rolled out a hotfix, issuing CVE-2026-18577 for the patch bypass.CVE-2026-29146The flaw was introduced in March, with the patch for CVE-2026-29146, a padding oracle issue in EncryptInterceptor, an optional channel interceptor that encrypts messages transmitted between nodes in Tomcat clusters.CVE-2026-34486Tracked as CVE-2026-34486 (CVSS score of 7.5), the third vulnerability added to the KEV catalog on Tuesday is an EncryptInterceptor bypass in Apache Tomcat that was patched in April.CVE-2026-9198Tracked as CVE-2026-9198 (CVSS score of 9.8), the Langflow OSS bug allows unauthenticated attackers to chain two API endpoints for remote code execution.

Malware

SNOWLIGHTwarned that CVE-2026-34486 had been exploited by a Chinese threat actor in attacks involving the Snowlight malware family, while Palo Alto Networks observed the vulnerability being exploited by Chinese hackers

Vendors

IBMThe US Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned that threat actors have been exploiting three vulnerabilities in IBM Langflow OSS, N-able N-central, and Apache Tomcat.N-ableThe US Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned that threat actors have been exploiting three vulnerabilities in IBM Langflow OSS, N-able N-central, and Apache Tomcat.

Products

Apache TomcatThe US Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned that threat actors have been exploiting three vulnerabilities in IBM Langflow OSS, N-able N-central, and Apache Tomcat.Langflow OSSThe US Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned that threat actors have been exploiting three vulnerabilities in IBM Langflow OSS, N-able N-central, and Apache Tomcat.N-centralThe US Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned that threat actors have been exploiting three vulnerabilities in IBM Langflow OSS, N-able N-central, and Apache Tomcat.

Related Articles