CISA Adds Langflow RCE, N-central Auth Bypass, and Tomcat Encryption Flaw to Actively Exploited Catalogue
CISA adds Langflow RCE, N-central auth bypass, and Tomcat encryption flaw to actively exploited catalogue with 48hr federal remediation deadline.
On August 4–5, 2026, federal cybersecurity authorities moved to harden government networks against a cluster of flaws already under active use by threat actors, adding three vulnerabilities with their assigned Common Vulnerabilities and Exposures designations to its Known Exploited Vulnerabilities catalog and ordering federal agencies to patch by August 7. The targeted software spans a wide range of infrastructure roles: Langflow, an open-source framework often used to build large language model applications; N-central, an information technology service management platform; and Apache Tomcat, a widely deployed web server and servlet container. The inclusion of Langflow CVE-2026-9198 as a critical remote code execution flaw with a CVSS rating of 9.8, alongside N-central authentication bypasses and an Apache Tomcat encryption defect, triggers the emergency catalog update, which establishes a BOD-mandated deadline compelling federal agencies to apply patches by August 7.
The risk profile of the Langrow vulnerability is defined by its severity and the simplicity of the required attack chain. Langflow CVE-2026-9198 enables an unauthenticated user to reach a code execution state without any credentials; details from threat monitoring show an unauthenticated actor can chain two API endpoints within Langflow to issue superuser tokens and execute arbitrary Python code, a capability that effectively compromises the underlying environment running the framework. For organizations relying on this tool for generative AI workflows, the exposure is immediate: an external party can escalate privileges to superuser and inject logic into the application’s execution context, turning what should be a development utility into a vector for full system control without detection.
The N-central vulnerabilities present a different class of challenge for defenders, primarily because the authentication bypass affects the core access controls of the platform in a way that resists simple remediation. CVE-2026-18556 and CVE-2026-18577 allow attackers to circumvent required login checks, granting unauthorized access to administrative functions; reporting indicates these flaws were exploited as zero-days before vendor mitigations could be deployed, and subsequent attempts to patch the issue have themselves been bypassed. This pattern suggests that the root cause lies deep within the authentication logic or state validation mechanisms, making incremental hotfixes insufficient for closing the gap while attackers continue to target environments where the incomplete patches are still applied.
Apache Tomcat CVE-2026-34486 introduces a regression that undermines data protection for applications relying on the container’s built-in security features. With a CVSS score of 7.5, this flaw allows an attacker to bypass the EncryptInterceptor, exposing data that should have been encrypted in transit; the issue was introduced by a single line of code change that caused the interceptor to fail open rather than enforcing encryption or returning a secure error. A regression of this nature highlights how minor modifications during maintenance windows can silently restore access to deprecated or disabled security controls, leaving applications vulnerable whenever those controls were expected to enforce confidentiality.
Federal agencies face a compressed timeline to address these issues, as the KEV designation signals that exploitation is not theoretical but already occurring against live targets. The urgency is compounded by the overlapping nature of the flaws: Langflow presents a straightforward remote code execution path, N-central undermines foundational access validation with patches that fail to hold, and Tomcat restores exposure through a regression in encryption logic. With the deadline set for August 7, infrastructure operators must prioritize remediation strategies that address not just the listed CVEs but the broader implications of actively exploited components across their stacks, ensuring that critical dependencies are updated and verified before the window closes.