U.S. Cybersecurity Agency Adds Critical Flaws to Exploited Vulnerabilities Catalog
Langflow, Apache Tomcat, and N-able N-central vulnerabilities require urgent patching for federal agencies by August 2026.
1Critical Vulnerabilities Identified in Key Systems
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. These include a remote code execution flaw in IBM Langflow with 9.8 CVSS score, an authentication bypass issue in N-able N-central, and a sensitive data encryption deficiency in Apache Tomcat. All these vulnerabilities are being actively exploited by malicious actors.
2Critical Flaw in IBM Langflow
Tracked as CVE-2026-9198, this vulnerability affects IBM Langflow versions 1.0.0-1.10.0. This authentication-free flaw allows attackers to gain superuser privileges and execute arbitrary code remotely. Particularly dangerous for critical infrastructure systems, it enables complete system takeover in default deployments.
3N-able N-central Authentication Bypass
Coded as CVE-2026-18556 with 8.2 CVSS score, this vulnerability permits unauthorized access to affected systems without valid credentials. Impacting all N-able N-central versions through 2026.1, it poses significant risks especially for cloud-based management systems targeted by sophisticated attacks.
4Apache Tomcat Data Encryption Gap
The 7.5 CVSS-rated CVE-2026-34486 affects Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116. This vulnerability bypasses the EncryptInterceptor, exposing sensitive data. Chinese threat actors were found exploiting this flaw using an AI-powered autonomous hacking agent based on DeepSeek technology.
5AI-Powered Cyber Attacks Emerging
Analysis of the Apache Tomcat exploit revealed Chinese attackers using an AI-driven autonomous attack tool. This sophisticated agent can automatically search for alternative vulnerabilities when one attack path fails. The same group manually exploited flaws in Citrix NetScaler, Marimo, and IKE VPN systems.
6Mandatory Patching Timeline for Federal Agencies
Under CISA's Binding Operational Directive (BOD) 22-01, all federal agencies must patch these vulnerabilities by August 7, 2026. This requirement aims to protect government networks against cyber attacks. Private sector organizations are strongly advised to review the catalog and update their infrastructure accordingly.
7Potential Impacts of These Vulnerabilities
The newly cataloged flaws particularly threaten critical infrastructure in finance, healthcare, and energy sectors. Ranging from data breaches to complete system compromise, these vulnerabilities enable various attack scenarios. Experts warn of potential large-scale cyber incidents if urgent patch management isn't implemented.
8Essential Steps for Enterprise Security
CISA's update underscores the need for organizations to reassess security priorities. Reviewing vulnerability management processes, timely patching, and proactive measures against AI-powered attacks are crucial. Regular security audits for internet-facing systems are particularly recommended to mitigate emerging threats.
Original article: Security Affairs — ABD Siber Güvenlik Ajansı Kritik Açıkları Listeye Ekledi