CISA KEV Alert: Langflow RCE Exploited at Scale, AI Agents in the Loop
CISA added an unauthenticated Langflow RCE, an Apache Tomcat cluster-encryption bypass, and two N-able N-central auth-bypass bugs to its KEV catalog on August 5 — one of them already chained by an actor using agentic AI tooling.
Key Takeaways
- CVE-2026-9198, a CVSS 9.8 unauthenticated RCE in the AI-workflow tool Langflow, has seen 650+ exploitation attempts from 244 IPs across 41 countries since July 6, 2026.
- CISA's August 5 KEV addition also covers an Apache Tomcat cluster-encryption bypass (CVE-2026-34486) and two chained N-able N-central authentication-bypass flaws (CVE-2026-18556, CVE-2026-18577).
- A Chinese-speaking actor reportedly used an agentic AI framework built on DeepSeek to autonomously chain the Tomcat exploitation — a preview of AI-accelerated attack tooling on the offense side.
- Federal agencies had only until August 7 to remediate — a two-day window that signals how seriously CISA is treating actively exploited, internet-facing management and AI-orchestration platforms.
What CISA added, and why the timing is tight
On August 5, 2026, CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: an unauthenticated remote code execution flaw in Langflow (CVE-2026-9198), a missing-encryption bypass in Apache Tomcat's clustering component (CVE-2026-34486), and a pair of chained authentication-bypass bugs in N-able N-central (CVE-2026-18556 and CVE-2026-18577). Federal civilian agencies were given until August 7 to remediate or disconnect affected systems — a two-day turnaround that reflects how CISA is prioritizing internet-facing management and AI-orchestration platforms this cycle.
The Langflow flaw: an unauthenticated RCE in an AI workflow platform
CVE-2026-9198 is a code injection vulnerability, rated CVSS 9.8, that lets an unauthenticated attacker achieve full remote code execution on default Langflow deployments. Langflow is a visual builder for AI workflows and agents, so a default, internet-exposed instance effectively hands an attacker the same execution context the workflow itself runs in. The vendor shipped a fix in version 1.10.1 in July 2026. Telemetry cited in the original report shows 650 exploitation attempts from 244 unique IP addresses across 41 countries since July 6 — activity that predates the KEV listing by roughly a month, meaning opportunistic scanning was already underway before this made the federal must-patch list.
An AI agent doing the exploiting, not just the exploited
The more notable detail for our readers sits with the Tomcat bug. CVE-2026-34486 lets an attacker bypass Tomcat's EncryptInterceptor clustering protection, and reporting attributes over 460 attempted exploits to a Chinese-speaking actor (aliases include knaithe and KnYuan, reportedly operating out of Zhuhai) using an agentic framework built on DeepSeek — described as a 'Hermes Agent' setup — to chain the exploitation autonomously. Whatever the framework's actual sophistication, it's a concrete example of AI-agent tooling being used operationally on the offensive side, not just as a hypothetical red-team scenario. It fits a beat we track closely: as agentic tooling gets easier to stand up, both attackers and defenders are automating more of the exploitation lifecycle, and the gap between vulnerability disclosure and mass exploitation keeps shrinking.
Tomcat and N-central: the unglamorous bugs that keep getting exploited
The Tomcat flaw was fixed back in April 2026 (versions 11.0.21, 10.1.54, and 9.0.117), and CVE-2026-18577 in N-able N-central is notable because it's a bypass of an *incomplete* fix for the earlier CVE-2026-18556 — a reminder that a patch closing a CVE doesn't always close the underlying access path. Both are classic RMM/infrastructure-management targets: high-value, often internet-reachable, and attractive because compromising one instance can expose everything it manages downstream.
What to do now
- Patch or isolate any Langflow instance to 1.10.1+ immediately, and treat internet-exposed pre-patch instances as potentially already compromised given the July exploitation activity.
- Confirm Tomcat clustering deployments are on 11.0.21 / 10.1.54 / 9.0.117 or later, and don't assume an April patch cycle already covered this if clustering wasn't in scope.
- Apply both N-able N-central fixes together — patching only CVE-2026-18556 leaves the CVE-2026-18577 bypass path open.
- Treat any AI-agent or workflow-orchestration platform (Langflow and its peers) as a first-class attack surface in your asset inventory, not a dev-tool exception.
650 exploitation attempts from 244 unique IP addresses across 41 countries
— The Hacker News, citing KEVIntel telemetry on CVE-2026-9198
Frequently Asked Questions
What makes CVE-2026-9198 in Langflow so severe?
It's an unauthenticated code injection flaw (CVSS 9.8) that gives an attacker full remote code execution on a default Langflow install with no login required — and telemetry shows active scanning and exploitation attempts from dozens of countries before it even reached the KEV catalog.
Is patching Langflow, Tomcat, and N-central enough?
Patch first, but given documented exploitation attempts predating the KEV listing, organizations that ran vulnerable, internet-facing instances should also review logs for signs of prior compromise rather than assuming a clean patch closes the incident.
Why does AI-agent tooling in the Tomcat exploitation matter?
It's a real-world instance of an actor reportedly using an agentic AI framework to chain exploitation steps autonomously, rather than a manual campaign — a trend worth tracking as agentic tooling lowers the effort required to operationalize known CVEs at scale.