What happened
On August 5, the Cybersecurity and Infrastructure Security Agency added three vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming attackers are using them in the wild. The most severe, CVE-2026-9198, is a code-injection flaw in Langflow, a popular tool for building AI workflows, rated 9.8 out of 10. It lets an unauthenticated attacker run code on default Langflow deployments; a fix shipped in version 1.10.1 in July. Telemetry cited by The Hacker News recorded roughly 650 exploitation attempts from 244 attacker IP addresses across 41 countries since July 6. The second flaw, CVE-2026-34486, weakens the encryption protecting traffic between Apache Tomcat cluster nodes and was patched back in April. The third, CVE-2026-18556, is an authentication bypass in N-able N-central, a remote monitoring and management platform widely used by managed IT providers; an incomplete first fix required a follow-up patch. Federal agencies were given until August 7 to remediate.
Why it matters for your business
KEV additions are the closest thing to a government-issued patch-this-now list, and two of these three flaws sit surprisingly close to small businesses. If you outsource IT to a managed service provider, there is a fair chance they administer your machines through a platform like N-central, and a compromised RMM tool hands attackers the same reach into your systems that your IT provider has. If your team has been experimenting with AI workflow tools like Langflow, an internet-exposed test server is exactly what this campaign is scanning for. Reporting on the Tomcat flaw also ties exploitation to AI-assisted attack tooling, a sign of how quickly older bugs get recycled.
What to do about it
- Ask your IT provider or MSP in writing whether they use N-able N-central and confirm it is patched for CVE-2026-18556 and the follow-up fix.
- Inventory any Langflow or other AI-tool servers your team has stood up, update Langflow to 1.10.1 or later, and take test instances off the public internet.
- If you run Apache Tomcat clusters, confirm you are on version 11.0.21, 10.1.54, or 9.0.117 or newer.