CVE-2026-9198
Affects IBM LangflowSource GCVE Database
Exploited in the wild · KEV due 7 Aug 2026 · public exploit available (Metasploit, Exploit-DB) · 28% EPSS : apply the vendor's fix or mitigations to IBM Langflow now.
Data as of 10/25/2026, 04:40:15 UTC
- Exploitation
Actively exploited – in CISA KEV since 08/04/2026
- KEV deadline
- 08/07/2026 US federal agencies must patch by this date; a sensible deadline for everyone else.
- EPSS
- 28.6% chance of exploitation in 30 days – higher than 98% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Public exploits
- 1 Metasploit module, 1 Exploit-DB entry, a Nuclei detection templatePublic attack or detection tooling exists; see Public exploits below.
What to do
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- ibm.com/support/pages/node/7278927 (opens in a new tab)
- cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk (opens in a new tab)
- cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk (opens in a new tab)
- nvd.nist.gov/vuln/detail/CVE-2026-9198 (opens in a new tab)
Public exploits and detection
Metasploit modules
Nuclei detection templates
Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.
Description
CVE-2026-9198 is a published vulnerability with no additional technical details, CVSS score, or known exploits currently available. No affected software versions or patch information have been provided.
Impact
Due to the absence of detailed information, the specific impact of CVE-2026-9198 cannot be determined at this time.
Summary
CVE-2026-9198 is identified as a vulnerability but lacks any detailed description, impact information, or remediation guidance. The available data does not specify the nature of the vulnerability, affected products or versions, or any exploitation details.
Weaknesses
- CWE-94Improper Control of Generation of Code ('Code Injection') (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #10OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.