CISA gives federal agencies three days to patch Langflow, N-central and Tomcat flaws under active attack

Key points - The U.S. Cybersecurity and Infrastructure Security Agency has given federal agencies until Friday, July 7th to patch three flaws already being used in real attacks. - The most serious, in IBM Langflow, scores 9.8 out of 10 and lets attackers run their own code on a server without ever logging in. - N-able shipped an emergency hotfix on Sunday for a bug in its N-central platform that hands administrator access to unauthenticated attackers. - Palo Alto Networks Unit 42 saw a Chinese-speaking group try to plant remote backdoors on nine Apache Tomcat servers on July 30. - Public step-by-step exploit code for the Langflow flaw appeared online in late July.

The U.S. Cybersecurity and Infrastructure Security Agency, known as CISA, told federal agencies this week to patch flaws in IBM Langflow, N-able N-central and Apache Tomcat by the end of Friday, July 7th. All three are confirmed being used in attacks right now. CISA has added them to its Known Exploited Vulnerabilities list, the catalogue government bodies must act on under binding operational directive.

BleepingComputer first reported the accelerated deadline.

What are these three products, in plain English?

Each sits deep inside company networks, which is exactly why attackers want them.

IBM Langflow is a visual tool developers use to build AI agents, the chatbot-style helpers that read data and take actions. N-able N-central is a remote monitoring platform that IT providers use to manage thousands of customer computers from one console. Apache Tomcat is web server software that runs Java applications behind the scenes on countless sites.

Break any of these and you get a foothold that reaches far beyond one machine.

Which flaw is the worst?

The Langflow one. CVE-2026-9198 scores 9.8 out of 10 and lets an attacker with no account and no password run their own commands on a default Langflow install by chaining two API requests to skip the login screen. That is authentication (proving who you are) bypassed entirely, so authorisation (what you are allowed to do) never gets a chance to say no.

Fully working exploit code, with instructions, showed up publicly in late July. Two weeks before that, CISA had already flagged a separate critical Langflow bug, CVE-2026-0770, being abused to gain root-level control. We first covered these Langflow vulnerabilities on 5 August in "CISA Adds Three Actively Exploited Bugs to Its Must-Patch List".

Multifactor authentication would not have saved anyone here. The bug skips login altogether.

What happened with N-able?

N-able patched a bug in N-central, then attackers found the patch was incomplete and started exploiting the leftover hole. The company warned customers on August 1st and shipped an emergency hotfix on Sunday, tracked as CVE-2026-18576. It lets an unauthenticated attacker take over administrator accounts on any N-central version before 2026.3.

That matters because N-central is used by managed service providers. One compromised server can expose hundreds of downstream customer networks.

And the Tomcat bug?

Apache Tomcat flaw CVE-2026-34486, rated 7.5, is itself an incomplete fix for an earlier critical bug, CVE-2026-29146, which carried a 9.8 severity score. On July 30, Unit 42 researchers reported a Chinese-speaking group attempting to drop reverse shells, small backdoors that phone home to the attacker, on nine Tomcat servers in a manual campaign.

The three flaws at a glance

Should ordinary people worry?

Not directly. These are enterprise products, not apps on your phone. But if the company holding your data runs any of them and drags its feet, your records could surface in a later breach notification. CISA has not said whether any of the three flaws are being used in ransomware campaigns; the agency says that is still unknown.

For everyone else: patch by Friday.