CISA's Cybersecurity Directive
The U.S. Cybersecurity and Infrastructure Security Agency has drawn a line in the sand for federal agencies: apply available mitigations for three actively exploited vulnerabilities by the end of Friday, August 7th. That's three days from the agency's August 5th warning — a timeline that reflects CISA's new risk-based patching mandate under BOD 26-04, which requires federal agencies to address critical vulnerabilities within days rather than weeks. The targets are IBM Langflow, N-able's N-central platform, and Apache Tomcat — all confirmed as being leveraged by threat actors in real-world campaigns.
CISA has added all three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, though the agency declined to specify whether these flaws are being used in ransomware campaigns. What it did share is urgent: the clock is ticking, and federal networks are already on the hook.
Here's what we know about each vulnerability, why they matter, and what teams should be doing right now.
The Langflow RCE Flaw: A Critical 9.8 Rating With Public Exploits
CVE-2026-9198 sits at the top of this triad — and for good reason. The vulnerability in IBM's Langflow visual framework for building AI agents carries a critical CVSS score of 9.8 out of 10. It allows an unauthenticated attacker to execute code remotely on default Langflow deployments by chaining together two API endpoints to bypass the login mechanism entirely.
In late July, multiple fully functional proof-of-concept exploits emerged in the public space, complete with step-by-step instructions on exploitation. That's the kind of accessibility that turns curious researchers into opportunistic threat actors overnight.
This isn't Langflow's first brush with CISA's attention. Just two weeks before this latest warning, CISA issued a separate alert for another critical Langflow vulnerability — CVE-2026-0770 — which was being exploited in attacks designed to gain remote code execution with root privileges. The pattern is clear: Langflow's default configurations are attractive, and the attack surface keeps expanding.
N-able's N-central: Admin Account Hijacking Persists Despite Patches
The second vulnerability, CVE-2026-18576, affects N-able's remote monitoring and management platform, N-central. This flaw allows attackers to hijack administrative accounts without any authentication whatsoever. It carries a high-severity rating and, despite being patched by the vendor, the fix proved insufficient — threat actors simply found a new way around it.
N-able warned its customers on August 1st that hackers were actively exploiting the vulnerability, which received its current CVE identifier. An emergency hotfix was released shortly after, and the company urged all customers to install it immediately. The flaw impacts all versions of N-central prior to version 2026.3, making the patch window especially tight for organizations running older builds.
What makes this particularly dangerous is the nature of N-central itself. It's a remote monitoring and management tool — the kind of software that often has broad access across an organization's IT infrastructure. Compromising an admin account through this flaw isn't just a single-system breach; it's a potential foothold across an entire network.
Apache Tomcat's Incomplete Fix: Reverse Shells and Missing Encryption
The third vulnerability, CVE-2026-34486, affects Apache Tomcat and carries a high-severity score of 7.5. It stems from an incomplete fix for CVE-2026-29146, a critical vulnerability rated 9.8 that involved the missing encryption of sensitive data.
On July 30, researchers at Palo Alto Networks' Unit 42 reported that a Chinese-speaking threat actor exploited CVE-2026-34486 in a manual campaign to plant reverse shells on nine Apache Tomcat servers. This wasn't automated scanning or opportunistic exploitation — it was a targeted, deliberate campaign. The attacker knew exactly what they were looking for and what they wanted to do once they got in.
Reverse shells are particularly insidious because they give attackers persistent, interactive access to compromised systems. They can move laterally, exfiltrate data, or pivot to other targets on the network. For federal agencies running web applications on Apache Tomcat, this vulnerability represents a direct path to persistent compromise.
Applying Cybersecurity Best Practices to This Emergency
CISA's directive is clear: apply available mitigations for all three products by the end of Friday, August 7th. The agency did not specify what types of attacks are leveraging these flaws, noting that it remains unknown whether they are being used in ransomware campaigns. But that omission doesn't make the threat any less real — it just means agencies should assume the worst.
For Langflow, the priority is ensuring that default deployments are not exposed to the internet without proper authentication controls. If you're running Langflow in production, review your API endpoint configurations and implement network-level access controls immediately.
For N-central, the emergency hotfix from N-able is the single most important action. If you're running a version before 2026.3, patch now. If you're already on 2026.3 or later, verify that your configuration doesn't expose the vulnerability through any workaround that threat actors have discovered.
For Apache Tomcat, apply the full fix for CVE-2026-29146, making sure that the incomplete remediation for CVE-2026-34486 is fully addressed. Review your server logs for signs of the reverse shell activity that Palo Alto Networks' researchers documented, and scan your environment for any indicators of compromise associated with the Chinese-speaking threat actor.
These emergency patch mandates follow a pattern we're seeing across CISA's recent cybersecurity directives targeting enterprise platforms under active attack. The three-day window is tight, but these vulnerabilities are actively being exploited right now. Every hour counts.
- CISA ordered federal agencies to apply available mitigations for three vulnerabilities by the end of Friday, August 7th (three days from publication on August 5, 2026)
- CVE-2026-9198 in IBM Langflow is critical (9.8/10) and allows unauthenticated RCE by chaining two API endpoints to bypass login; multiple PoC exploits emerged in late July
- CISA previously issued an alert two weeks prior for another critical Langflow vulnerability, CVE-2026-0770
- CVE-2026-18576 in N-able N-central allows admin account hijacking without authentication; N-able warned customers August 1 and released an emergency hotfix for all versions before 2026.3
- CVE-2026-34486 in Apache Tomcat carries a 7.5 severity score and stems from an incomplete fix for CVE-2026-29146 (critical 9.8, missing encryption of sensitive data)
- Palo Alto Networks Unit 42 (July 30) reported a Chinese-speaking threat actor exploited CVE-2026-34486 to plant reverse shells on nine Apache Tomcat servers
- CISA added all three to its Known Exploited Vulnerabilities (KEV) catalog; it remains unknown if they are used in ransomware campaigns
