CISA KEV adds Langflow, Tomcat, N-central flaws

What Happened

On August 5, 2026, CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The additions include CVE-2026-9198, an unauthenticated remote code execution flaw in Langflow, alongside critical weaknesses in Apache Tomcat and N-able N-central. Federal agencies are required to remediate these flaws by the August 26 deadline under Binding Operational Directive 22-01, but the implications extend well beyond government networks.

Why It Matters

These three products occupy sensitive positions in enterprise infrastructure. Langflow is a popular low-code platform for building AI and LLM applications, often deployed with internet-facing interfaces for development teams. Apache Tomcat underpins countless Java web applications and is frequently exposed to the public internet. N-able N-central is a remote monitoring and management (RMM) platform used by managed service providers (MSPs) to administer thousands of client endpoints simultaneously.

The combination is particularly dangerous: an RCE in an AI development tool, a web server runtime, and an RMM platform gives attackers three distinct footholds into enterprise environments with vastly different security postures. Compromise of N-able N-central specifically could cascade into supply-chain attacks, allowing threat actors to push malicious commands to every managed endpoint.

Technical Details

CVE-2026-9198 is an unauthenticated RCE in Langflow that requires no user interaction or valid credentials. Public proof-of-concept code is already circulating, which historically correlates with a sharp uptick in mass exploitation attempts. The flaw exists in API endpoints that fail to properly validate user-supplied input before passing it to backend processing functions.

The Tomcat and N-central vulnerabilities are not fully detailed in the public reporting, but CISA’s inclusion in the KEV catalog signals confirmed exploitation. Organizations running these products should assume that scanning and exploitation attempts are already underway across the broader internet. Attackers frequently chain these types of flaws with initial access brokers who resell footholds to ransomware operators.

Immediate Risk

The risk window is narrow. For Langflow instances, the lack of authentication requirement makes internet-exposed deployments critically vulnerable right now. Any Langflow instance accessible from untrusted networks should be considered compromised until proven otherwise. For Tomcat, organizations should check version parity against the latest patches immediately. N-able customers should verify that their instances are updated to the vendor’s latest release, and MSPs should audit N-central logs for suspicious administrative actions or unexpected script execution.

Given the documented active exploitation, the realistic timeline for weaponized exploitation is already in progress. CISA’s deadline for federal agencies is August 26, but private sector organizations should treat this as a same-week patching priority.

Security Insight

The inclusion of an AI development platform like Langflow in the KEV catalog marks a notable shift: attackers are now systematically targeting AI supply-chain tooling, not just the models themselves. This mirrors the 2023-2024 wave of attacks on CI/CD pipelines and package registries, where attackers realized that developer tools grant privileged access to production environments with far less monitoring than traditional endpoints.

The defensive takeaway is to audit development tools with the same rigor applied to production infrastructure. Low-code and AI prototyping platforms are frequently deployed with default settings, broad API access, and minimal logging. Treat any tool that can execute code or trigger backend workflows as a crown jewel, regardless of whether it is considered a “production” system. Segment these platforms from core networks and require authentication even for internal deployments, since the Langflow flaw demonstrates that “internal” no longer means safe.

Further Reading

• Langflow unauthenticated RCE exploited in wild (CVE-2026-9198) [PoC]
• Latest Security News
• CVE Advisories
• Data Breach Reports