ON 4 August 2026 the Cybersecurity and Infrastructure Security Agency added three flaws to its Known Exploited Vulnerabilities catalogue, including two authentication bypass issues in N‑able N‑central tracked as CVE‑2026‑18556 and CVE‑2026‑18577. The agency also listed a critical code injection bug in IBM Langflow (CVE‑2026‑9198) and a data encryption gap in Apache Tomcat (CVE‑2026‑34486). The additions follow confirmed exploitation in the wild and come with a deadline for federal agencies to apply fixes by 7 August 2026.
CVE‑2026‑18556 and CVE‑2026‑18577 each carry a CVSS v3.1 score of 8.2 and stem from insufficient validation of session tokens in the N‑central web interface (details and details). An unauthenticated attacker can send a specially crafted request that tricks the system into granting administrative privileges without needing valid credentials. The flaw affects all versions prior to the 2026.3 hotfix 1 release and can be chained with other post‑exploitation tools to gain full control of the management server.
The IBM Langflow vulnerability, CVE‑2026‑9198, scores 9.8 and permits unauthenticated remote code execution by injecting malicious payloads into the platform’s REST API endpoint (details). Apache Tomcat’s CVE‑2026‑34486, rated at 7.5, occurs when the EncryptInterceptor fails to encrypt certain session attributes (details), allowing an attacker to bypass protection and read or alter sensitive data. Both flaws are exploitable without authentication and have been seen in active attacks.
CISA’s KEV entry notes that active exploitation of the N‑central bypass has been observed, though no specific threat actor has been publicly attributed (KEV entry). Security teams at managed service providers have reported suspicious login attempts and unexpected admin account creation coinciding with the vulnerability disclosure. The IBM Langflow and Tomcat flaws have likewise been linked to recent intrusion attempts targeting cloud‑based workloads and internal applications.
Vendors have issued patches: N‑able released hotfix 1 for the 2026.3 branch (hotfix), IBM made available a Langflow update that validates API input, and Apache published a Tomcat release that restores proper encryption in the EncryptInterceptor. Administrators should apply these updates as soon as possible, following the mitigations outlined in the respective security advisories and the CISA guidance accompanying the KEV entries.
Defenders should start by confirming which assets run the affected products, then prioritize patching of internet‑facing servers and internal management consoles. Reviewing authentication logs for anomalous privilege escalation attempts and monitoring outbound connections from compromised hosts can help detect early signs of abuse. Where immediate patching is not feasible, implementing network segmentation and enforcing multi‑factor authentication on administrative interfaces can reduce risk until updates are applied.