CISA has added three vulnerabilities with confirmed active exploitation to the Known Exploited Vulnerabilities (KEV) catalog: a critical RCE in Langflow (CVE-2026-9198, CVSS 9.8), an encryption bypass in Apache Tomcat (CVE-2026-34486, CVSS 7.5), and an authentication bypass in N-able N-central (CVE-2026-18556, CVSS 8.2). U.S. federal civilian agencies are required to remediate these vulnerabilities by August 7, 2026. Particular attention is drawn to the attribution of the Tomcat exploitation: according to Unit 42, it is linked to an autonomous campaign in which a Chinese-speaking threat actor used DeepSeek as an offensive operator.
Technical details of the vulnerabilities
CVE-2026-9198 — remote code execution in Langflow
A code injection vulnerability in the AI application development platform Langflow allows an unauthenticated attacker to achieve full remote code execution on default deployments. The CVSS score is 9.8 (critical). A fix was released in July 2026 in version 1.10.1. Details on specific exploitation scenarios have not yet been disclosed, but Langflow has repeatedly been targeted by threat actors in recent months.
CVE-2026-34486 — encryption bypass in Apache Tomcat
The vulnerability in Apache Tomcat is related to a lack of encryption for sensitive data in the clustering component EncryptInterceptor, which provides message encryption between cluster nodes using a pre-negotiated key. Bypassing this mechanism (CVSS 7.5) allows an attacker to intercept or tamper with inter-node traffic. According to the official Apache advisory, a fix has been available since April 2026 in versions 11.0.21, 10.1.54, and 9.0.117.
CVE-2026-18556 and CVE-2026-18577 — authentication bypass in N-able N-central
The authentication bypass vulnerability in the remote management platform N-able N-central (CVSS 8.2) has received particular attention due to the incompleteness of the initial fix. N-able released a follow-up patch, assigned the identifier CVE-2026-18577 (CVSS 8.2). Notably, CVE-2026-18577 had already been added to KEV earlier, and the inclusion of the original CVE-2026-18556 confirms that both vulnerabilities are being actively exploited by threat actors. This means that organizations that applied only the first patch remain vulnerable.
Threat context: autonomous AI campaign
The most significant aspect of this KEV update is the exploitation context of CVE-2026-34486. According to research by Palo Alto Networks Unit 42, exploitation of this vulnerability is tied to an autonomous hacking campaign run by a Chinese-speaking threat actor operating under the aliases knaithe and KnYuan. The attacker is believed to be based in Zhuhai, China.
According to the Unit 42 report, the attacker used the DeepSeek model via the Hermes Agent framework as an autonomous offensive operator for attacks on internet-exposed devices. When initial attempts to exploit the Langflow vulnerability (CVE-2026-33017, CVSS 9.8) failed due to restrictive configurations in the target environment, the AI agent reportedly conducted its own reconnaissance to search for alternative vulnerabilities, including flaws in the automation platform n8n.
In parallel, the same threat actor carried out manual operations using known vulnerabilities in Citrix NetScaler (CVE-2026-3055), Marimo (CVE-2026-39987), Apache Tomcat (CVE-2026-34486), and IKE VPN (CVE-2026-33824).
Unit 42 estimates that the attacker targeted more than 460 victims, combining autonomous and manual methods. The researchers emphasize that the threat actor apparently allowed DeepSeek to narrow the targeting scope—likely to conserve AI compute resources. The autonomous process of identifying targets, sampling them, and narrowing the focus accomplished in minutes what would have required hundreds of hours of manual analysis.
It should be noted that the attribution of the campaign is based on a single research report by Unit 42 and has not been independently confirmed by government or other sources.
Impact assessment
Taken together, these vulnerabilities create a broad attack surface affecting several categories of organizations:
- AI application development teams using Langflow — a critical unauthenticated RCE on default deployments means that any internet-accessible Langflow instance can be fully compromised.
- Apache Tomcat cluster operators — an EncryptInterceptor bypass jeopardizes the confidentiality of inter-node data exchange, which is particularly critical for distributed systems processing sensitive information.
- Managed service providers (MSPs) using N-able N-central — an authentication bypass in the remote management platform could potentially open access to the entire infrastructure of an MSP’s customers.
The emergence of autonomous AI agents in attackers’ toolkits fundamentally changes attack dynamics: the scale of reconnaissance and the speed of pivoting between targets and vulnerabilities exceed what is possible with manual testing.
Practical recommendations
- Langflow: immediately update to version 1.10.1 or later. Check whether Langflow instances are exposed to the internet, and if there is no business need, restrict access through network segmentation.
- Apache Tomcat: update to versions 11.0.21, 10.1.54, or 9.0.117 depending on the branch in use. Review the EncryptInterceptor configuration in clustered deployments and ensure that inter-node traffic does not traverse untrusted networks.
- N-able N-central: verify that a patch covering both vulnerabilities—CVE-2026-18556 and CVE-2026-18577—is installed. The initial fix was incomplete, and applying only one patch does not provide protection.
- Conduct a perimeter audit to identify exposed instances of Langflow, Tomcat, N-central, as well as Citrix NetScaler, Marimo, n8n, and IKE VPN mentioned in the campaign.
- For U.S. federal agencies (FCEB): the remediation deadline is August 7, 2026.
The three vulnerabilities added to KEV require immediate patching—especially given that at least one of them is being exploited as part of an automated campaign using an AI agent capable of independently selecting targets and switching between vulnerabilities. Organizations using Langflow, Apache Tomcat in a clustered configuration, or N-able N-central should treat updating as a top-tier priority and, in parallel, review logs for signs of compromise for the period prior to the release of patches.
