Technology newsroom
CISA Urgent Alert! 🚨 Critical Vulnerabilities Found in Langflow, Tomcat, and N-central Actively Exploited
CISA has added 3 new vulnerabilities affecting Langflow, Apache Tomcat, and N-able N-central to its KEV Catalog after finding evidence of active exploitation by hackers, especially the critical RCE vulnerability in Langflow with a severity rating of 9.8/10.
📌 Key Highlights:
- CISA has added 3 new vulnerabilities in popular software to its KEV Catalog after finding evidence of widespread exploitation by hackers.
- The Langflow vulnerability (CVE-2026-9198) has a critical severity rating of 9.8/10, allowing unauthenticated remote attackers to take over systems.
- System administrators using Langflow, Apache Tomcat, and N-able N-central should check for and apply security patches as soon as possible.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a significant warning on August 5, 2026, adding three new security vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. This catalog lists vulnerabilities that CISA has confirmed are currently being actively exploited by malicious actors.
🎯 Spotlight on Key Vulnerabilities
One of the most concerning vulnerabilities is CVE-2026-9198, a Code Injection vulnerability in Langflow, a platform for building LLM applications. This vulnerability has a critical severity rating with a CVSS score of 9.8 out of 10. It allows unauthenticated attackers to execute malicious code remotely (Remote Code Execution - RCE) and gain complete control over the system.
⚠️ Other Software Also at Risk
In addition to Langflow, CISA has also added vulnerabilities affecting Apache Tomcat, a highly popular web server, and N-able N-central, a Remote Monitoring and Management (RMM) software, to the KEV list. Their inclusion in the KEV catalog confirms that these are real, active threats, not merely theoretical ones.
Organizations and system administrators utilizing these three software products must therefore apply the security patches released by developers as quickly as possible. This will close off avenues for malicious actors to exploit these vulnerabilities and cause damage to systems and critical data.
💬 Does your organization use Langflow, Tomcat, or N-central? Have you checked for and applied the patches yet?