U.S. CISA adds Langflow, Apache Tomcat, and N-able N-central flaws to its Known Exploited Vulnerabilities catalog

N-able's N-central RMM platform contains an authentication bypass (CWE-288) in which an alternate path or channel allows requests to skip the normal authentication check. An unauthenticated attacker can trigger it by sending requests through that alternate path without valid credentials, gaining unauthorized access to the N-central management interface; because N-central is remote monitoring and management software run by managed service providers, such access can expose management functions across downstream customer environments. N-able N-central deployments are affected; the available data does not specify affected version ranges or fixed builds. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-04, confirming exploitation in the wild, with a high EPSS of 40.2% (99th percentile), no CVSS score yet, no public PoC, and undetermined ransomware use; related reporting describes a recent string of N-central hotfixes, including fixes for unauthenticated remote code execution.

Do: Apply N-able's hotfix for N-central immediately per the vendor's instructions, since the flaw is in CISA KEV and BOD 26-04 applies (for cloud-hosted N-central, apply mitigations per BOD 26-04 or discontinue use if mitigations are unavailable). Until patched, restrict internet exposure of the N-central server to trusted management networks and review authentication logs for unexpected access, following CISA's forensics triage guidance. Check the vendor advisory for the exact fixed build, as the available data does not list affected or fixed version numbers.

CVE-2026-34486 is a missing-encryption vulnerability in Apache Tomcat in which the EncryptInterceptor, the component that encrypts Tomcat cluster communication, can be bypassed in a fail-open manner; the flaw was introduced as a regression by the fix for CVE-2026-29146. It affects Tomcat 11.0.20, 10.1.53 and 9.0.116, and is triggered when cluster communication is expected to be encrypted: an attacker positioned on the network path between cluster nodes receives inter-node traffic in cleartext. By reading that unencrypted traffic, the attacker can obtain sensitive data such as session payloads, potentially enabling session theft and authentication bypass as indicated by related reporting. Only deployments running the affected point releases with the EncryptInterceptor in use are impacted, including Tomcat shipped in Red Hat JBoss Web Server and Red Hat Enterprise Linux channels. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-04, EPSS places 30-day exploitation probability at 98.6%, though no public proof-of-concept is known and ransomware use is unconfirmed.

Do: Upgrade Apache Tomcat to 11.0.21, 10.1.54 or 9.0.117, and apply the corresponding Red Hat JBoss Web Server / Enterprise Linux updates when published. Audit Tomcat cluster configurations for EncryptInterceptor usage, and until patched restrict or encrypt the network segment carrying inter-node cluster traffic. Because the flaw is in CISA's KEV catalog, federal agencies must patch per BOD 26-04 timelines and should review cluster nodes for signs of session data interception.

IBM Langflow OSS 1.0.0 through 1.10.0 contains an unauthenticated code-injection flaw (CWE-94) that can be chained into full remote code execution. An attacker with network access first calls /api/v1/auto_login, which mints a SUPERUSER token to any caller without authentication, then calls /api/v1/validate/code, which executes attacker-supplied code via exec() on the Langflow host. Successful exploitation yields full control of the affected deployment, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 9.8, network-exploitable with no privileges or user interaction required). Anyone running IBM Langflow OSS 1.0.0-1.10.0 is affected, especially default deployments reachable from untrusted networks. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-08-04, confirming active exploitation; EPSS estimates a 60.6% probability of exploitation within 30 days (99th percentile), and ransomware use is unknown.

Do: Upgrade IBM Langflow OSS to a release newer than 1.10.0 per IBM's ([email protected]) security advisory, as required under CISA's BOD 26-04 guidance for KEV entries; if mitigations are unavailable, discontinue use of the product per BOD 26-04. Until patched, restrict network access to the /api/v1/auto_login and /api/v1/validate/code endpoints (e.g., firewall rules or reverse-proxy controls) and avoid exposing the instance directly to the internet. Because exploitation is confirmed, review access logs for requests to these endpoints and signs of unauthenticated SUPERUSER token issuance or unexpected code execution.