Active Exploitation Triggers KEV Alerts for Langflow, Apache Tomcat, and N-central

Threat actors are actively exploiting critical vulnerabilities across enterprise infrastructure and open-source AI frameworks, targeting IBM Langflow OSS, Apache Tomcat, and N-able N-central. The most severe issue, a remote code execution flaw in Langflow tracked as CVE-2026-9198, allows unauthenticated attackers to compromise default deployments, while an EncryptInterceptor bypass in Apache Tomcat (CVE-2026-34486) is actively fueling automated, AI-driven attack campaigns. Additionally, persistent zero-day targeting against N-able N-central’s administrative interface has forced a secondary hotfix after initial mitigations were bypassed.

Federal Civilian Executive Branch (FCEB) agencies have been mandated to remediate all four vulnerabilities by August 7, 2026, under Binding Operational Directive requirements. Given the public availability of proof-of-concept exploits and active weaponization in the wild, private sector security teams should treat these flaws with equal urgency.

Analyzing CVE-2026-9198, CVE-2026-34486, and N-Central Bypasses

The flaw in IBM Langflow OSS (CVE-2026-9198, CVSS 9.8) stems from an unsafe API design that combines two distinct implementation weaknesses on default installations. An unauthenticated endpoint automatically issues superuser bearer tokens to any incoming network request. Attackers can obtain this token without credentials and immediately pass arbitrary Python code to a separate code validation endpoint, which executes the payload directly on the host system. Because Langflow is frequently deployed as an orchestration engine for LLM applications with access to underlying databases, API keys, and internal environments, remote code execution here effectively hands attackers full control over the AI pipeline and its connected data stores.

In Apache Tomcat, CVE-2026-34486 (CVSS 7.5) affects cluster deployments configured with EncryptInterceptor—an optional component designed to secure inter-node communications using pre-shared keys. The vulnerability was inadvertently introduced in March during a patch for a padding oracle flaw (CVE-2026-29146). A single relocated line of code altered the cluster logic from fail-closed to fail-open. When an unencrypted or improperly encrypted message fails decryption, Tomcat no longer drops the packet; instead, it passes the raw payload directly up the interceptor chain to the deserialization layer. An unauthenticated attacker sending crafted payloads directly to Tomcat cluster ports can trigger Java deserialization, resulting in remote code execution across all nodes in the cluster.

The N-able N-central vulnerabilities (CVE-2026-18556 and CVE-2026-18577, CVSS 8.2) target remote monitoring and management (RMM) infrastructure. CVE-2026-18556 was initially leveraged as a zero-day flaw allowing unauthenticated network callers to bypass administrative authentication. Because RMM platforms sit at the root of trust for managed service providers (MSPs) and enterprise IT departments, gaining administrative control provides lateral movement access to thousands of downstream endpoints. N-able’s initial patch proved incomplete, allowing attackers to construct a patch bypass tracked as CVE-2026-18577, which saw immediate operational use before a hotfix was distributed.

AI-Driven Autonomous Attack Campaigns

Exploitation of these vulnerabilities showcases a significant shift in threat actor operations, highlighted by an AI-enabled campaign orchestrated by a Chinese-speaking adversary operating under the handles knaithe and KnYuan, based out of Zhuhai, China.

Rather than running standard automated vulnerability scanners, this adversary integrated the DeepSeek large language model into the Hermes Agent framework to act as an autonomous offensive operator. In one observed sequence, the agent attempted to breach a target using an older Langflow RCE (CVE-2026-33017). When restrictive network policies blocked the initial exploit, the autonomous agent did not abort; instead, it conducted self-directed reconnaissance to discover alternative attack vectors, identifying secondary vulnerabilities in workflow automation tools like n8n and switching tactics in real time.

Unit 42 research indicates the threat actor directed this AI framework across more than 460 target environments. The AI agent autonomously managed its compute usage, dynamically narrowing the scope of targets and sampling responses to conserve model tokens while performing hundreds of hours of manual targeting analysis in minutes.

Alongside these autonomous agent runs, the adversary conducted manual exploitation against exposed endpoints—leveraging Tomcat’s CVE-2026-34486 alongside vulnerabilities in Citrix NetScaler (CVE-2026-3055), Marimo (CVE-2026-39987), and IKE VPN endpoints (CVE-2026-33824). Furthermore, SOCRadar confirmed separate activity where threat actors leveraged the Apache Tomcat EncryptInterceptor flaw to deliver the Snowlight malware family.

Required Remediation and Patch Guidance

Organizations utilizing affected software should immediately verify their deployment versions and apply vendor-issued updates:

• IBM Langflow OSS: Upgrade all instances to version 1.10.1 or later. If updating cannot occur immediately, isolate Langflow API interfaces behind strict network access controls or authentication gateways, as default setups allow unauthenticated administrative access.
• Apache Tomcat: Upgrade Tomcat clusters using EncryptInterceptor to versions 11.0.21, 10.1.54, or 9.0.117 or higher. Restrict access to Tomcat cluster communication ports (typically 4000/TCP or custom cluster channels) so they are inaccessible from the open internet or untrusted internal segments.
• N-able N-central: Ensure N-central servers are updated past the initial CVE-2026-18556 fix to apply the recent late-July hotfix covering CVE-2026-18577. Verify administrative access logs for unauthorized sessions established during late July and early August.