CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws
Source Bleeping Computer
Mentioned vulnerabilities
Fixed in 2026.3 : patch affected systems soon.
Data as of 7 Aug 2026, 18:03 UTC
Rated High by Threat Radar from the Bleeping Computer text
- Patch
- Available – fixed in 2026.3
What to do
AI-suggested
For Langflow, immediate application of vendor patches and mitigations is required due to critical remote code execution vulnerabilities with public exploits. For N-able N-central, customers must install the emergency hotfix released on August 1st, 2026, which addresses the administrative account hijacking vulnerability affecting all versions before 2026.3. For Apache Tomcat, ensure the latest patches are applied to address CVE-2026-34486, which fixes the incomplete prior patch. CISA mandates federal agencies to complete mitigation by July 7th, 2026. Organizations should follow vendor advisories closely and apply all official fixes promptly. No vendor advisory states that no action is required or that the issues are already mitigated; thus, urgent patching is recommended.
Description
The U.S. Cybersecurity and Infrastructure Security Agency is giving federal agencies three days to mitigate vulnerabilities in IBM Langflow, N-central, and Apache Tomcat, all actively exploited. [...]