CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited
Summary: CISA added three flaws to its Known Exploited Vulnerabilities catalog on August 5, 2026, citing evidence of active exploitation in the wild, including an authentication bypass in N-able N-central (CVE-2026-18556) whose incomplete fix prompted a fresh patch tracked as CVE-2026-18577. KEVIntel telemetry recorded 650 exploitation attempts against CVE-2026-9198 from 244 unique attacker IP addresses across 41 countries starting July 6, 2026, and exploitation of CVE-2026-34486 has been attributed to a Chinese-speaking actor in Zhuhai using DeepSeek via the Hermes Agent framework, who attempted to exploit over 460 targets.
Key Takeaway: A single actor attempted more than 460 targets by mixing autonomous AI-driven targeting with manual exploitation, and a separate China-nexus campaign used nine CVEs to breach 107 endpoints across more than 100 countries - while FCEB agencies had until August 7, 2026, just two days after the KEV listing, to apply fixes.