The US Cybersecurity and Infrastructure Security Agency (CISA) warned of active exploitation of three vulnerabilities: CVE-2026-9198 in IBM Langflow OSS, CVE-2026-18556 and CVE-2026-18577 in N-able N-central, and CVE-2026-34486 in Apache Tomcat. CVE-2026-9198 (CVSS 9.8) allows unauthenticated attackers to obtain superuser bearer tokens via an auto-login endpoint and then execute arbitrary Python code through a code validation endpoint. IBM patched this in Langflow OSS version 1.10.1. N-able N-central's CVE-2026-18556 (CVSS 7.4) is an authentication bypass exploited as a zero-day to gain administrative access; an initial patch was bypassed, prompting a hotfix CVE-2026-18577. Apache Tomcat's CVE-2026-34486 (CVSS 7.5) is an EncryptInterceptor bypass that turns the encryption layer from fail-closed to fail-open, enabling unauthenticated remote code execution on cluster members; this was patched in April following the introduction of a related padding oracle flaw CVE-2026-29146. These vulnerabilities are listed in CISA's Known Exploited Vulnerabilities catalog, with active exploitation observed, including by Chinese threat actors using malware such as Snowlight. CISA mandates patching by August 7, 2026.

These vulnerabilities enable unauthenticated remote code execution and authentication bypass, allowing attackers to gain administrative or superuser access, execute arbitrary code, and potentially control affected systems. The Langflow OSS flaw allows attackers to chain API endpoints to obtain superuser tokens and execute Python code remotely. The N-able N-central vulnerabilities have been exploited to bypass authentication and gain administrative access to managed systems. The Apache Tomcat EncryptInterceptor bypass allows unauthenticated remote code execution on cluster members, undermining encryption protections. Exploitation has been observed in the wild, including by advanced threat actors deploying malware, posing significant risk to affected organizations.

IBM has released Langflow OSS version 1.10.1 to address CVE-2026-9198; users should upgrade immediately. N-able issued a hotfix addressing CVE-2026-18556 and CVE-2026-18577; affected users must apply the hotfix to fully remediate the authentication bypass. Apache Tomcat patched CVE-2026-34486 in April; users should ensure they have applied the April patch to prevent EncryptInterceptor bypass exploitation. CISA urges all federal agencies and affected organizations to apply these patches by August 7, 2026. No vendor advisory indicates these vulnerabilities are already mitigated without patching; therefore, timely patching is critical.