3 new KEV entries: IBM Langflow and what else CISA flagged
On 2026-08-04 CISA added three entries to the Known Exploited Vulnerabilities (KEV) catalog: an unauthenticated remote code execution in IBM Langflow, an encryption bypass in Apache Tomcat that chains into a prior RCE, and the second half of an N-able N-central authentication bypass pair. Together with a Cisco Secure Firewall Management Center hard-coded password flaw added the week before, the batch paints a clear picture: attackers are hitting management planes, AI orchestration stacks, and long-lived Java middleware, and CISA has evidence that each is being exploited in the wild.
This post covers what each flaw is, how CISA's KEV process defines "actively exploited," how to check whether your estate is affected, and what to do within the Binding Operational Directive 22-01 remediation window that governs federal civilian agencies (and that most private-sector programs mirror by policy).
The four flaws, in defender's terms
CVE-2026-9198: IBM Langflow, unauthenticated RCE. Langflow is a visual builder for LLM pipelines. CISA's KEV entry describes a code injection vulnerability that lets unauthenticated attackers execute arbitrary code remotely on default Langflow deployments. "Default deployment" is the key phrase: this is not a hardened-configuration edge case. If Langflow was stood up to prototype an internal agent and then forgotten on a VM behind a permissive security group, that host is open to immediate takeover.
CVE-2026-34486: Apache Tomcat, EncryptInterceptor bypass, chainable with CVE-2025-24813. The KEV note confirms this is a missing-encryption flaw against the EncryptInterceptor, chainable with CVE-2025-24813. That earlier Tomcat CVE is the partial-PUT deserialization RCE from 2025. In practice, a cluster relying on EncryptInterceptor to keep inter-node traffic confidential loses that guarantee under this attack, and any operator who dismissed CVE-2025-24813 as "internal only, mTLS between nodes" needs to revisit that assumption.
CVE-2026-18556 and CVE-2026-18577: N-able N-central, authentication bypass via alternate path. These two are linked. CVE-2026-18556 was added 2026-08-04; CVE-2026-18577 was added the day before and is explicitly the result of an incomplete patch for CVE-2026-18556, enabling authentication bypass and account takeover. N-central is an MSP-grade RMM console. An account takeover here is not a single-tenant compromise; it is a supply-chain foothold into every managed endpoint the console reaches.
CVE-2026-20316: Cisco Secure Firewall Management Center, hard-coded password. Added 2026-07-29. FMC (formerly Firepower Management Center) governs the firewall estate. The KEV description says an unauthenticated remote attacker can log in with a low-privileged account using the hard-coded credential and reach sensitive data. Low-privileged read access to a firewall management plane is a reconnaissance goldmine: rule sets, object groups, VPN topology, and change history.
Why "KEV" is a stronger signal than "critical CVSS"
The KEV catalog is not a severity ranking. CISA adds an entry only when it has reliable evidence of active exploitation, the CVE is assigned, and a clear remediation exists. That evidentiary bar is what makes KEV useful for prioritization: unlike a raw CVSS score, a KEV listing means attackers are exploiting the flaw now. Under BOD 22-01, federal civilian agencies must remediate KEV entries by the due date CISA sets, typically two to three weeks from the add date. Private-sector teams that mirror the same posture through policy or contract should treat 2026-08-25 as the working deadline for the 2026-08-04 additions and 2026-08-19 for the Cisco FMC entry.
Fast triage: are you affected?
Start with asset inventory, not scanning. Scanners will find Tomcat instances and the FMC. They may miss the shadow Langflow that a data-science team stood up on an EC2 instance last quarter. Two commands worth running:
# Langflow: find processes and containers by name and default port 7860
ps -eo pid,cmd | grep -iE 'langflow|uvicorn.*langflow' | grep -v grep
docker ps --format '{{.Names}}\t{{.Image}}\t{{.Ports}}' | grep -iE 'langflow|:7860'
ss -tlnp | awk '$4 ~ /:7860$/'
# Tomcat: version, and whether the EncryptInterceptor is configured
find / -name catalina.sh 2>/dev/null -exec sh -c '"$1" version' _ {} \;
grep -RIn --include='server.xml' 'EncryptInterceptor' /opt /etc /var /usr/local 2>/dev/null
For N-central, check the vendor-supplied version string in the console footer against the fixed build in N-able's security advisory for CVE-2026-18577 (the incomplete-patch CVE); anything that only received the CVE-2026-18556 fix is still vulnerable. For Cisco FMC, version checks alone are insufficient. Review authentication logs for the low-privileged account name Cisco identifies in its advisory and flag any successful logins from outside your management VLAN.
What "remediate" means for each
- Langflow (CVE-2026-9198): Patch to the fixed release, but do not stop there. Because exploitation is unauthenticated against default deployments, treat any internet-exposed instance running a vulnerable version as compromised. Rotate any secrets the Langflow process could read (LLM provider API keys, database DSNs, tool credentials), review outbound network logs from the host, and inspect the flow-definition store for injected nodes.
- Tomcat (CVE-2026-34486, chained with CVE-2025-24813): Upgrade Tomcat and confirm that CVE-2025-24813 is patched across every node, not just the ingress-facing one. The chain assumes CVE-2025-24813 is safe behind the EncryptInterceptor; that assumption no longer holds.
- N-central (CVE-2026-18556 / -18577): Apply the CVE-2026-18577 patch specifically. Because the earlier fix was incomplete, an operator who patched in the first window may still be exposed. After patching, review admin-tier account activity and MFA enrollment history for the console.
- Cisco FMC (CVE-2026-20316): Apply Cisco's fix and, per Cisco's advisory, remove or disable the account tied to the hard-coded credential. Audit access logs back to the earliest FMC version that shipped the credential; a low-privileged read account is precisely the kind of access an attacker keeps quiet.
Track the deadline, not the ticket
The recurring failure mode is not "we did not know about the KEV entry." It is "we opened a ticket, assigned it, and the ticket outlived the CISA due date." KEV additions deserve their own SLA board, wired to asset inventory, with a named owner per platform (Java middleware, RMM, firewall management, AI tooling). Two weeks is not much time to find every shadow Langflow. Start now.
Verifiable security.