Full research report
CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited
Executive assessment
The strongest conclusion is narrow: CISA confirms current exploitation of CVE-2026-9198, CVE-2026-18556 and CVE-2026-34486, while Huntress independently documents exploitation of the related N-central follow-up CVE-2026-18577. Each flaw crosses a high-value boundary—unauthenticated execution in Langflow, encrypted cluster trust in Tomcat, or centralised remote administration in N-central—so exposed instances warrant both immediate remediation and retrospective compromise review. Unit 42 substantiates related activity by knaithe and KnYuan, but its Langflow attempt failed and its Tomcat observations are described as attempts, preventing blanket attribution of the current CISA entries. Public technical analysis exists for the Tomcat weakness, whereas the current Langflow exploitation method, victim scope and operator remain undisclosed.
What happened
On 4 August 2026, the US Cybersecurity and Infrastructure Security Agency added CVE-2026-9198, CVE-2026-18556 and CVE-2026-34486 to its Known Exploited Vulnerabilities catalogue on the basis of active exploitation. The event followed the 3 August addition of CVE-2026-18577, an N-central authentication-bypass issue resulting from an incomplete correction for CVE-2026-18556. Published research also places CVE-2026-34486 and several older catalogue entries within separate opportunistic campaigns observed earlier in 2026.
Affected scope
CVE-2026-9198 affects Langflow OSS 1.0.0 through 1.10.0. CVE-2026-34486 affects Apache Tomcat 11.0.20, 10.1.53 and 9.0.116 where the relevant cluster encryption component is in use. CVE-2026-18556 and CVE-2026-18577 affect susceptible N-able N-central deployments, including hosted and on-premises systems, with downstream risk to every endpoint managed through a compromised remote monitoring and management server.
Technical assessment
The Langflow flaw chains unauthenticated superuser-token issuance with unsafe code validation, permitting remote code execution on default deployments. The Tomcat regression causes failed cluster-message decryption to proceed rather than fail closed, potentially exposing an unsafe deserialisation boundary to any system able to reach the cluster listener. The N-central flaws bypass normal authentication and can expose administrative functions, including Take Control, enabling access to managed endpoints. CISA's catalogue status establishes exploitation, but it does not disclose the exploit telemetry, operators or success rates behind each new entry.
Recommended defensive actions
- Immediately upgrade Langflow OSS to version 1.10.1 or later and remove untrusted network access until the upgrade is complete.
- Patch Apache Tomcat to 11.0.21, 10.1.54 or 9.0.117 or later, according to the deployed branch.
- Apply the N-central 2026.3 HF1 hotfix, reported by Huntress as build 2026.3.1.7, to every hosted and on-premises server.
- Restrict Tomcat cluster listeners, Langflow services and N-central management interfaces to explicitly authorised networks and management hosts.
- Hunt for unexpected Langflow superuser-token activity, suspicious child processes, Tomcat cluster decryption errors followed by accepted traffic, and N-central Take Control sessions using the default MSP Support identity.
- Review Windows Application Event IDs 4102, 8192 and 8193 on N-central-managed systems and investigate unexplained remote sessions, process enumeration or rapid movement between hosts.
- Rotate credentials and revoke active sessions where an affected service was internet-accessible before remediation, treating patching alone as insufficient assurance.
Uncertainties and evidence gaps
- CISA has not publicly described the operators, victim counts or exploitation methods supporting the three 4 August catalogue additions.
- No verified public reporting reviewed here attributes current CVE-2026-9198 exploitation to a named threat actor or identifies its post-compromise activity.
- Unit 42 observed Tomcat reverse-shell attempts against nine servers, but its publication does not establish that every attempt produced a successful compromise.
- Claims connecting CVE-2026-34486 and CVE-2026-41940 to a separate SNOWLIGHT campaign spanning more than 100 countries were available through secondary reporting, but the cited original SOCRadar page was inaccessible during verification.
- The exact affected-version range for the N-central flaws was not established from an accessible vendor advisory; the independently accessible Huntress report confirms the required 2026.3.1.7 hotfix.
- The supplied reporting identifies CVE-2026-3055, but the reviewed sources did not establish its distinct role in this event.
- The supplied reporting identifies CVE-2026-33017, but the reviewed sources did not establish its distinct role in this event.
- The supplied reporting identifies CVE-2026-33824, but the reviewed sources did not establish its distinct role in this event.
- The supplied reporting identifies CVE-2026-39987, but the reviewed sources did not establish its distinct role in this event.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Confirmed active exploitation of CVE-2026-9198, CVE-2026-18556 and CVE-2026-34486; CVE-2026-18577 was also actively exploited, and public technical analysis demonstrates the Tomcat flaw's exploitability.
The investigation began by separating CISA's three new exploitation determinations from earlier campaigns mentioned for context. CISA and the vendor advisories established the affected components and fixed releases, while Huntress supplied independent confirmation and defensive telemetry for N-central. Unit 42 and Striga clarified the campaign context and Tomcat mechanism, but the available evidence does not justify attributing every current exploitation event to the named operators or to the SNOWLIGHT campaign.
- What event does the headline describe, and which claims require primary verification?Reviewed the supplied article and followed its cited references.thehackernews.com ↗
The article identifies three new catalogue additions and places them alongside earlier Langflow, Tomcat, N-central and China-nexus activity.
why This framed the core event while preserving the distinction between the new exploitation determinations and historical campaign context.
- Does the second supplied outlet independently support the story?Opened the supplied BleepingComputer article.bleepingcomputer.com ↗
The site presented a browser-verification challenge, so its substantive reporting could not be checked.
why The page was not used to support any factual conclusion or reference entry.
- Did CISA formally confirm active exploitation of the three headline vulnerabilities?Read CISA's 4 August alert.cisa.gov ↗
CISA added CVE-2026-9198, CVE-2026-18556 and CVE-2026-34486 based on evidence of active exploitation.
why This is the strongest available authority for the current exploitation status.
- What Langflow releases are affected and fixed?Read IBM's Langflow security bulletin.ibm.com ↗
Langflow OSS 1.0.0 through 1.10.0 is affected; version 1.10.1 fixes an unauthenticated remote-code-execution chain involving privileged-token issuance and code validation.
why This established product scope, mechanism and the specific remediation without relying on the news report.
- Which Tomcat releases contain CVE-2026-34486 and what fixes it?Read the Apache Tomcat security announcement.lists.apache.org ↗
The affected releases are 11.0.20, 10.1.53 and 9.0.116; fixed releases are 11.0.21, 10.1.54 and 9.0.117.
why This narrowed the scope to three regression releases and supplied authoritative upgrade targets.
- Is N-central exploitation independently observed, and what activity should defenders seek?Reviewed Huntress's incident response report.huntress.com ↗
Huntress observed exploitation across multiple organisations, subsequent reconnaissance and lateral movement, and abuse of N-central Take Control; it identifies build 2026.3.1.7 as the hotfix.
why This corroborated exploitation separately from CISA and provided concrete host-level detection opportunities.
- Do the named operators and related CVEs belong to the same current exploitation event?Read Unit 42's campaign analysis.unit42.paloaltonetworks.com ↗
Unit 42 associates knaithe and KnYuan with automated Langflow attempts and separate manual activity involving CVE-2026-3055, CVE-2026-39987, CVE-2026-34486 and CVE-2026-33824; the observed Langflow CVE-2026-33017 attempts failed under the target conditions.
why This confirmed related campaign context but showed that attempted exploitation must not be presented as successful current exploitation.
- Can the reported SNOWLIGHT campaign claims be verified at their original source?Opened the cited SOCRadar research page.socradar.io ↗
A browser-verification challenge prevented review of the underlying analysis.
why The SNOWLIGHT attribution, global scope and reported CVE-2026-41940 compromises remain secondary claims rather than firm conclusions here.
- Is there public technical material demonstrating exploitation significance for the Tomcat flaw?Read the reporting researcher's technical analysis.striga.ai ↗
Striga reports building a working exploit and shows that the regression changes cluster-message handling from fail closed to fail open before unsafe deserialisation.
why This confirms public exploit knowledge and explains why network exposure of the cluster listener is operationally important, without equating publication with the separate evidence of in-the-wild exploitation.
Research coverage
All 68 registered source leaves were evaluated for this run: 59 completed, 0 were unavailable, 2 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (3 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 54 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| BleepingComputernews | ok7 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA KEVkev | ok1661 records | Primary evidence9 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok14 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok7492 records | Context8 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | stale fallback0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok672 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1007 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok16 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok16 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | ok900 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 13 opened outside the registered collection
Vulnerability & exploitation16
PoC & exploit code1
The reporting researcher documents a working CVE-2026-34486 exploit and explains the affected Tomcat trust boundary.
Vendor & gov advisories3
CISA confirms active exploitation of CVE-2026-9198, CVE-2026-18556 and CVE-2026-34486.
Identifies Langflow OSS 1.0.0 through 1.10.0 as affected and directs users to upgrade to 1.10.1.
Identifies Tomcat 11.0.20, 10.1.53 and 9.0.116 as affected and supplies fixed versions.
Analysis & research3
Reports exploitation across multiple organisations, abuse of Take Control and observable Windows event records.
Connects knaithe and KnYuan to vulnerability scanning and attempts against Langflow, Tomcat, Citrix, Marimo and IKE VPN systems.
Provides the initial event summary and links the new KEV additions to previously reported campaigns.