CISA 2026-08-04

CISA KEV — IBM Langflow (CVE-2026-9198) +2 more

Machine-generated analysis · WAYSCloud LLM

CISA added three new KEV entries: IBM Langflow code injection (CVE-2026-9198), N-able N-central authentication bypass (CVE-2026-18556), and Apache Tomcat missing encryption (CVE-2026-34486). These are flagged for rapid remediation on publicly exposed assets.

Context

The advisory lists IBM Langflow, N-able N-central, and Apache Tomcat as the affected products. CISA added CVE-2026-9198, CVE-2026-18556, and CVE-2026-34486 to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation and recommends rapid remediation on publicly exposed assets that grant total control. While the Binding Operational Directive applies to federal agencies, CISA encourages all organizations to adopt the same risk-based approach.

Operator considerations

Check: Verify whether IBM Langflow, N-able N-central, or Apache Tomcat are deployed and identify their versions.
Isolate: Segment or restrict network access to any publicly exposed instances of these products until they are remediated.
Patch: Apply vendor-provided patches or mitigations for CVE-2026-9198, CVE-2026-18556, and CVE-2026-34486 as soon as they become available.
Log: Monitor logs for exploitation attempts or anomalous activity related to the three CVEs.

From Cybersecurity and Infrastructure Security Agency ↗

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-9198 IBM Langflow Code Injection Vulnerability

CVE-2026-18556 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by C...

Read the full advisory on CISA →