# U.S. Cybersecurity Agency Adds Critical Flaws to Exploited Vulnerabilities Catalog Langflow, Apache Tomcat, and N-able N-central vulnerabilities require urgent patching for federal agencies by August 2026. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-08-05 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/0c3ad246-dc32-419d-914c-e871893e6c21 ## Critical Vulnerabilities Identified in Key Systems The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. These include a remote code execution flaw in IBM Langflow with 9.8 CVSS score, an authentication bypass issue in N-able N-central, and a sensitive data encryption deficiency in Apache Tomcat. All these vulnerabilities are being actively exploited by malicious actors. ## Critical Flaw in IBM Langflow Tracked as CVE-2026-9198, this vulnerability affects IBM Langflow versions 1.0.0-1.10.0. This authentication-free flaw allows attackers to gain superuser privileges and execute arbitrary code remotely. Particularly dangerous for critical infrastructure systems, it enables complete system takeover in default deployments. ## N-able N-central Authentication Bypass Coded as CVE-2026-18556 with 8.2 CVSS score, this vulnerability permits unauthorized access to affected systems without valid credentials. Impacting all N-able N-central versions through 2026.1, it poses significant risks especially for cloud-based management systems targeted by sophisticated attacks. ## Apache Tomcat Data Encryption Gap The 7.5 CVSS-rated CVE-2026-34486 affects Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116. This vulnerability bypasses the EncryptInterceptor, exposing sensitive data. Chinese threat actors were found exploiting this flaw using an AI-powered autonomous hacking agent based on DeepSeek technology. ## AI-Powered Cyber Attacks Emerging Analysis of the Apache Tomcat exploit revealed Chinese attackers using an AI-driven autonomous attack tool. This sophisticated agent can automatically search for alternative vulnerabilities when one attack path fails. The same group manually exploited flaws in Citrix NetScaler, Marimo, and IKE VPN systems. ## Mandatory Patching Timeline for Federal Agencies Under CISA's Binding Operational Directive (BOD) 22-01, all federal agencies must patch these vulnerabilities by August 7, 2026. This requirement aims to protect government networks against cyber attacks. Private sector organizations are strongly advised to review the catalog and update their infrastructure accordingly. ## Potential Impacts of These Vulnerabilities The newly cataloged flaws particularly threaten critical infrastructure in finance, healthcare, and energy sectors. Ranging from data breaches to complete system compromise, these vulnerabilities enable various attack scenarios. Experts warn of potential large-scale cyber incidents if urgent patch management isn't implemented. ## Essential Steps for Enterprise Security CISA's update underscores the need for organizations to reassess security priorities. Reviewing vulnerability management processes, timely patching, and proactive measures against AI-powered attacks are crucial. Regular security audits for internet-facing systems are particularly recommended to mitigate emerging threats. ## Sources covering this story - https://securityaffairs.com/196667/hacking/u-s-cisa-adds-langflow-apache-tomcat-and-n-able-n-central-flaws-to-its-known-exploited-vulnerabilities-catalog.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._