Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations

Langflow versions up to and including 1.6.9 chain two web-security weaknesses - a permissive CORS configuration (allow_origins='*' with allow_credentials=True) and a refresh-token cookie set with SameSite=None - into account takeover and remote code execution. When an authenticated Langflow user visits an attacker-controlled webpage, the browser silently sends credentialed cross-origin requests that successfully call the refresh endpoint, letting the attacker mint fresh access_token/refresh_token pairs for the victim's session (CWE-346). With those tokens, the attacker can access authenticated endpoints, including Langflow's built-in code-execution functionality, and run arbitrary code for full system compromise. Any Langflow deployment at or below version 1.6.9 is affected, with internet-facing instances most exposed. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-21, and EPSS assigns an 83.6% probability of exploitation within 30 days (100th percentile).

Do: Upgrade Langflow to a release newer than 1.6.9 following vendor guidance, and invalidate existing sessions afterward. If patching must wait, correct the CORS configuration (do not combine allow_origins='*' with allow_credentials=True), stop marking the refresh-token cookie SameSite=None, and restrict internet exposure of the instance. Review access logs for refresh-endpoint calls from unexpected origins, rotate tokens and credentials for suspected victims, and follow BOD 22-01 requirements if you are a U.S. federal agency.

SmarterTools SmarterMail contains an unrestricted file upload flaw (CWE-434, CVSS 10.0) that lets an unauthenticated attacker upload files of dangerous types over the network without any credentials or user interaction. Because the uploaded files can be written to any location on the mail server, an attacker can drop a file into an executable path and achieve remote code execution on the host, which is why the CVSS scope is changed with high confidentiality, integrity and availability impact. An attacker who lands this foothold gains control of the mail server, and CISA notes known ransomware use, with press coverage linking the wave of SmarterMail exploitation to groups such as Storm-1175 and Warlock. Any organization running an internet-facing SmarterMail server — typically hosting providers, MSPs and SMBs using it as a Windows mail platform — is exposed. Exploitation is active: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26, EPSS puts the 30-day exploitation probability at 85.7% (100th percentile), and a public proof-of-concept exploit is available from watchTowr.

Do: Upgrade SmarterMail to the patched build referenced in the vendor advisory (exact build number not provided in the source data), prioritizing internet-exposed servers, and note that news reports indicate exploit activity began within roughly two days of the patch release, so unpatched systems should be assumed targeted. Check servers for signs of compromise — unexpected files in web-accessible or executable paths, new admin accounts, webshells, and ransomware indicators — and restrict webmail endpoints to trusted networks if immediate patching is not possible. US federal agencies must apply the required mitigation or discontinue use under BOD 22-01 timelines.

CVE-2025-54068 is an improper hydration flaw (CWE-94 code injection) in Livewire v3, a full-stack framework for Laravel, that allows unauthenticated attackers to achieve remote command execution in specific scenarios. The flaw is triggered when a Livewire component is mounted and configured in a particular way and receives certain component property updates, with no authentication or user interaction required. A successful attacker gains code execution on the server hosting the affected Laravel application. Only Livewire v3 up to and including v3.6.3 is affected; earlier major versions are not impacted, and the issue is fixed in v3.6.4. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog (added 2026-03-20, patching deadline 2026-04-03), indicating confirmed exploitation in the wild, and EPSS assigns a 96.5% probability of exploitation within 30 days.

Do: Upgrade Livewire to v3.6.4 or later immediately, as no workarounds are available. Audit Laravel applications for Livewire v3 usage and identify components mounted and configured in the vulnerable property-hydration pattern, prioritizing internet-facing apps. Federal agencies must apply vendor mitigations or discontinue use by the BOD 22-01 deadline of April 3, 2026.

n8n, an open source workflow automation platform, contains a critical remote code execution vulnerability (CVE-2025-68613, CWE-913) in its workflow expression evaluation system, affecting versions starting at 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0. The flaw is triggered when expressions supplied by authenticated users during workflow configuration are evaluated in an execution context that is not sufficiently isolated from the underlying runtime, allowing the attacker to execute arbitrary code with the privileges of the n8n process. Successful exploitation can result in full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. Any self-hosted or cloud n8n deployment running an affected version is exposed, with public scans indicating roughly 24,700 instances remain exposed on the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-03-11, EPSS places the 30-day exploitation probability at 99.1% (100th percentile), and Akamai has documented a ZeroBot malware campaign targeting n8n instances.

Do: Upgrade immediately to n8n 1.120.4, 1.121.1, or 1.122.0 (or later), as the flaw is in CISA KEV and actively exploited by the ZeroBot malware campaign documented by Akamai. If immediate upgrade is not possible, restrict workflow creation and editing permissions to fully trusted users and run n8n in a hardened environment with restricted OS privileges and network access, keeping in mind these mitigations do not fully eliminate the risk. Review instances for signs of compromise, including unexpected workflow changes and suspicious process activity, and apply BOD 22-01 requirements if the product is used in federal cloud services.

N-able N-central versions before 2025.4 contain a flaw (CWE-1284, improper validation of an input quantity) that allows the server to generate session IDs for unauthenticated users. An attacker can trigger this remotely over the network with no privileges or user interaction required. Per the CVSS 4.0 score of 6.9 (medium), the impact is limited to confidentiality (VC:L), meaning an attacker can obtain or create session identifiers without authenticating, potentially enabling session hijacking or unauthorized access to the N-central console. Any organization running N-central prior to 2025.4 — primarily managed service providers (MSPs) using the RMM platform — is affected. No public proof-of-concept exists and the flaw is not in CISA's KEV catalog, but the EPSS score of 36.3% (98th percentile) indicates an elevated probability of exploitation in the next 30 days.

Do: Upgrade N-central to version 2025.4 or later. Until patched, restrict internet exposure of N-central consoles via VPN or firewall allowlisting, review active sessions for anomalies, and monitor the vendor's security advisories given the elevated EPSS likelihood.