bleeping-computer Aug 5, 2026 · Crawled Aug 5, 2026

CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws

4 CVEs

AI Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned federal agencies of active exploitation of three critical vulnerabilities in IBM Langflow, N-able N-central, and Apache Tomcat. The Langflow flaw (CVE-2026-9198) allows unauthenticated remote code execution by chaining API endpoints, with proof-of-concept exploits publicly available. A second Langflow vulnerability (CVE-2026-0770) is also being exploited for root-level remote code execution. The N-central vulnerability (CVE-2026-18576) enables attackers to hijack administrative accounts without authentication, despite prior patching attempts. The Apache Tomcat flaw (CVE-2026-34486), stemming from an incomplete fix for a prior encryption issue, is being exploited by a Chinese-speaking threat actor to deploy reverse shells. CISA has added all three CVEs to its Known Exploited Vulnerabilities catalog and mandated mitigation within three days.

AI-extracted · verify before operational use

Extracted Entities 4 found

CVE CVE-2026-9198 → CVE CVE-2026-0770 → CVE CVE-2026-34486 → CVE CVE-2026-29146 →

MITRE ATT&CK TTPs 19 techniques

T1059 Command and Scripting Interpreter · Execution T1078 Valid Accounts · Defense Evasion T1190 Exploit Public-Facing Application · Initial Access T1210 Exploitation of Remote Services · Lateral Movement T1484 Domain or Tenant Policy Modification · Defense Evasion T1059.004 Unix Shell · Execution T1070.004 File Deletion · Defense Evasion T1083 File and Directory Discovery · Discovery T1105 Ingress Tool Transfer · Command And Control T1135 Network Share Discovery · Discovery T1505.003 Web Shell · Persistence T1552 Unsecured Credentials · Credential Access T1619 Cloud Storage Object Discovery · Discovery T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1090 Proxy · Command And Control T1133 External Remote Services · Persistence T1566 Phishing · Initial Access T1588.001 Malware · Resource Development