CISA has added three actively exploited flaws affecting IBM Langflow, N-able N-central and Apache Tomcat to its Known Exploited Vulnerabilities catalog. The August 4 update requires US federal civilian agencies to apply vendor mitigations by August 7, while private-sector operators using the products face the same confirmed exploitation risk. BleepingComputer reported the additions on August 5.

The catalog action covers CVE-2026-9198 in Langflow, CVE-2026-18577 in N-central and CVE-2026-34486 in Tomcat. CISA uses the catalog for vulnerabilities with evidence of exploitation in the wild, but it did not identify the attackers or say whether ransomware operations are using these flaws. The products span AI workflow development, remote monitoring and Java application hosting, creating exposure across different enterprise environments.

IBM rates CVE-2026-9198 critical at 9.8. Its bulletin says an unauthenticated attacker can chain an auto-login endpoint that issues a superuser token with a code-validation endpoint that executes Python code. Langflow OSS versions 1.0.0 through 1.10.0 are affected, and IBM recommends upgrading to version 1.10.1 because no workaround is available.

N-able says CVE-2026-18577 is an authentication bypass caused by an incomplete correction for CVE-2026-18576. The company detected active exploitation affecting N-central releases before 2026.3 and issued hotfix 2026.3.1.7. Hosted systems received the update, while on-premises customers must install it. N-able also supplied customers with indicators, including a Cloudflared service and an svchost.exe file in a user documents folder.

Apache describes CVE-2026-34486 as a bypass of the EncryptInterceptor correction for CVE-2026-29146. Apache security records show affected release ranges across Tomcat 9, 10 and 11. Unit 42 separately documented a Chinese-speaking actor attempting to plant reverse shells on nine Tomcat servers through CVE-2026-34486, providing public evidence of the exploitation activity behind the catalog decision.

Administrators should inventory exposed Langflow, N-central and Tomcat deployments, install the vendor-fixed releases or hotfix, and review systems for signs of compromise rather than treating patching alone as proof that an intrusion did not occur. CISA directs organizations to follow vendor instructions, discontinue a product if mitigations are unavailable, and complete the federal remediation deadline by August 7.