The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has alerted federal agencies to actively exploited vulnerabilities in IBM Langflow, N-able N-central, and Apache Tomcat. The Langflow vulnerability (CVE-2026-9198) is critical (CVSS 9.8) and allows unauthenticated remote code execution by chaining two API endpoints to bypass login. Proof-of-concept exploits are publicly available. Another critical Langflow vulnerability (CVE-2026-0770) has also been exploited for root-level remote code execution. N-able N-central's vulnerability (CVE-2026-18576) enables attackers to hijack administrative accounts without authentication; although initially patched, an emergency hotfix was issued after threat actors found new exploitation methods. This flaw affects all versions before 2026.3. Apache Tomcat's vulnerability (CVE-2026-34486) has a high severity (7.5) and results from an incomplete fix of a previous critical vulnerability (CVE-2026-29146). Threat actors, including a Chinese-speaking group, have attempted exploitation to deploy reverse shells. CISA has added these vulnerabilities to its Known Exploited Vulnerabilities catalog and ordered immediate mitigation by federal agencies. The agency has not disclosed whether these are linked to ransomware or other specific attack types.

These vulnerabilities enable unauthenticated remote code execution (Langflow), administrative account hijacking without authentication (N-central), and potential remote code execution or unauthorized access (Apache Tomcat). Active exploitation increases the risk of system compromise, unauthorized control, and potential deployment of malicious payloads. The availability of public proof-of-concept exploits for Langflow heightens the threat. The incomplete patch for Apache Tomcat and the need for an emergency hotfix for N-central indicate ongoing exploitation risks. The impact is critical to high, affecting federal agency infrastructure and potentially broader environments using these products.

For Langflow, immediate application of vendor patches and mitigations is required due to critical remote code execution vulnerabilities with public exploits. For N-able N-central, customers must install the emergency hotfix released on August 1st, 2026, which addresses the administrative account hijacking vulnerability affecting all versions before 2026.3. For Apache Tomcat, ensure the latest patches are applied to address CVE-2026-34486, which fixes the incomplete prior patch. CISA mandates federal agencies to complete mitigation by July 7th, 2026. Organizations should follow vendor advisories closely and apply all official fixes promptly. No vendor advisory states that no action is required or that the issues are already mitigated; thus, urgent patching is recommended.