CVE Tools
Track your stack

CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws

BleepingComputerBy Ionut Ilascu

Reported exploitedLangflowN-central

Our summary

Federal agencies have until July 7 to address three actively exploited vulnerabilities in IBM Langflow, N-central, and Apache Tomcat, as highlighted by CISA. The most severe flaw, CVE-2026-9198 in IBM's Langflow, enables unauthenticated remote code execution with a CVSS score of 9.8. A related vulnerability, CVE-2026-0770, also allows RCE with root privileges and has already seen public PoCs. Meanwhile, a patched but re-exploitable flaw in N-central (CVE-2026-18576) permits unauthorized account takeover, while Apache Tomcat faces an incomplete fix for another issue (CVE-2026-34486). All three vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities list.

Read at BleepingComputer

BleepingComputer publishes this story on its own site; we link to it rather than reprint it.

  1. SecurityWeekCISA Warns of Exploited Langflow, N-central, and Tomcat VulnerabilitiesCVE-2026-29146, CVE-2026-34486 +1
  2. BleepingComputerCritical Langflow flaw exploited to steal OpenAI and AWS keysCVE-2026-0770, CVE-2026-9198
  3. The Hacker NewsCISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively ExploitedCVE-2026-34486, CVE-2026-9198
  4. BleepingComputerCISA orders feds to patch actively exploited TrueConf Server flawsCVE-2026-0770
  5. BleepingComputerN-able warns of N-central auth bypass flaw exploited in attacksCVE-2026-18576
  6. The Hacker NewsThreatsDay: AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More StoriesCVE-2026-34486
  7. Palo Alto Unit 42Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous CyberattacksCVE-2026-34486
  8. The Hacker NewsHackers Exploit Windmill Flaw to Read Arbitrary Server Files Without AuthenticationCVE-2026-0770
  9. BleepingComputerCISA orders urgent action on actively exploited Langflow RCE flawCVE-2026-0770
  10. The Hacker NewsCISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEVCVE-2026-0770

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store