CISA has placed three more enterprise flaws in its Known Exploited Vulnerabilities catalog: Langflow CVE-2026-9198, N-able N-central CVE-2026-18556, and Apache Tomcat CVE-2026-34486. Federal civilian agencies have until August 7 to remediate affected, exposed systems and perform the triage required by CISA’s current directive.
The most direct takeover path affects Langflow OSS 1.0.0 through 1.10.0 in its default configuration. IBM says an unauthenticated caller can obtain a superuser bearer token, then send Python to a validation endpoint that executes parts of the submitted code. Teams running Langflow, self-hosted N-central, or encrypted Tomcat clusters should treat inventory and compromise checks as today’s work, not a routine patch cycle.
Figure details
Three exploited trust-boundary failures and the version or build that closes each path.
Langflow joins two unsafe defaults into remote code execution
Langflow’s chain begins at /api/v1/auto_login. In affected default deployments, IBM says the endpoint mints a SUPERUSER token for any network caller. That token opens /api/v1/validate/code, a validator that passes submitted Python to exec().
The attacker does not need to call a finished function. Python evaluates decorators, default argument expressions, and annotations while defining it, so hostile code in those positions can run on the Langflow host during validation. The result is network-reachable, unauthenticated code execution with no user interaction. IBM assigns a 9.8 CVSS score, lists no workaround, and identifies 1.0.0 through 1.10.0 as affected. That makes 1.10.1 or later the required fixed state.
CISA confirms exploitation but has not published the observed request sequence, payloads, or actor. Defenders should not present the two-endpoint chain as the confirmed in-the-wild method; it is the vendor-documented mechanism that makes the affected systems exploitable.
Tomcat’s patched encryption path still admitted plaintext
Tomcat CVE-2026-34486 is narrower but easy to misread. It does not make every Tomcat web application remotely executable. It affects the EncryptInterceptor used to protect messages between cluster nodes.
Apache says an error in the fix for the earlier padding-oracle flaw CVE-2026-29146 allowed the interceptor to be bypassed. The affected releases are specifically Tomcat 11.0.20, 10.1.53, and 9.0.116. Upgrade to 11.0.21, 10.1.54, or 9.0.117 or later in the same supported line. Teams that do not use clustered messaging with EncryptInterceptor should record that configuration state rather than treating a generic Tomcat inventory as proof of exposure.
CISA’s listing establishes active exploitation, but neither CISA nor Apache supplies public exploitation artifacts in these records. Network telemetry that shows unexpected cluster peers or unencrypted replication traffic can support an investigation; absence of those signals does not replace the version and configuration check.
N-central requires both patching and a compromise hunt
CISA’s third addition, CVE-2026-18556, is an authentication bypass in N-central. The catalog points defenders to the N-able response for the follow-on CVE-2026-18577, an alternate authentication path left after the earlier fix. CISA added that follow-on flaw to KEV on August 3 and set an August 6 deadline; the newly listed CVE-2026-18556 carries the August 7 deadline.
N-able says all instances below N-central 2026.3.1 remain affected by CVE-2026-18577. For self-hosted systems, the concrete closing build is 2026.3.1.7. Hosted N-central customers receive the update through N-able.
Do not close the incident on the version string alone. N-able tells customers to inspect managed devices’ user Documents folders for a file named svchost.exe and check for a registered service named Cloudflared. Its notice also lists four IP addresses for hunting: 173.249.252[.]200, 87.249.138[.]34, 37.19.210[.]32, and 68.235.46[.]214. A match warrants immediate escalation to the vendor and the organization’s incident-response team.
Close the deadline with evidence, not a patch ticket
Start with externally reachable inventory, then preserve logs before changing the systems. For Langflow, record the running version, whether auto-login was enabled, and whether the validation endpoint was reachable from untrusted networks. Review reverse-proxy and application logs for unexpected calls to both endpoints, new bearer-token activity, and child processes or outbound connections from the Langflow service account.
For Tomcat, establish whether the affected one-release version and EncryptInterceptor configuration coexist. Preserve cluster membership and network telemetry, patch the exact supported line, then confirm that every node restarted on the fixed build.
For N-central, preserve appliance, authentication, administrative-action, and managed-device telemetry. Upgrade self-hosted servers to build 2026.3.1.7 or later, hunt the vendor’s artifacts across managed endpoints, and rotate privileged credentials if investigation shows unauthorized access.
The durable result is threefold: no affected version remains reachable, the relevant configuration or build has been verified after restart, and the pre-patch exposure window has been investigated without unexplained authentication, execution, cluster, or persistence artifacts.