CISA gives federal agencies three days to patch Langflow, N-central and Tomcat flaws under active attack

Key points

• The U.S. Cybersecurity and Infrastructure Security Agency has given federal agencies until Friday, July 7th to patch three flaws already being used in real attacks.
• The most serious, in IBM Langflow, scores 9.8 out of 10 and lets attackers run their own code on a server without ever logging in.
• N-able rushed out an emergency hotfix on Sunday for a bug in its N-central platform that hands administrator access to unauthenticated attackers.
• Palo Alto Networks Unit 42 saw a Chinese-speaking group try to plant remote backdoors on nine Apache Tomcat servers on July 30.
• Public step-by-step exploit code for the Langflow flaw appeared online in late July.

Three bugs. Three products federal agencies actually run. And three days to fix them.

The U.S. Cybersecurity and Infrastructure Security Agency, known as CISA, told federal agencies this week to patch flaws in IBM Langflow, N-able N-central and Apache Tomcat by the end of Friday, July 7th. All three are being used in attacks right now, and CISA has added them to its Known Exploited Vulnerabilities list, the catalogue government bodies must act on quickly.

BleepingComputer first reported the accelerated deadline.

What are these three products, in plain English?

They are pieces of software that sit deep inside company networks, which is exactly why attackers want them.

IBM Langflow is a visual tool developers use to build AI agents, the chatbot-style helpers that read data and take actions. N-able N-central is a remote monitoring platform that IT providers use to manage thousands of customer computers from one screen. Apache Tomcat is a widely used piece of web server software that runs Java applications behind the scenes on countless websites.

Break any of these and you get a foothold that reaches far beyond one machine.

Which flaw is the worst?

The Langflow one. CVE-2026-9198 scores 9.8 out of 10 and lets an attacker with no account and no password run their own commands on a default Langflow install by stringing two web requests together to skip the login screen. That is authentication (proving who you are) bypassed entirely, so authorisation (what you're allowed to do) never gets a chance to say no.

Fully working exploit code, with instructions, showed up publicly in late July. Two weeks before that, CISA had already flagged a separate critical Langflow bug, CVE-2026-0770, being abused to gain root-level control.

Multifactor authentication would not have saved anyone here. The bug skips login altogether.

What happened with N-able?

N-able patched a bug in N-central, then attackers found the patch was incomplete and started exploiting the leftover hole. The company warned customers on August 1st and shipped an emergency hotfix on Sunday, tracked as CVE-2026-18576. It lets an unauthenticated attacker take over administrator accounts on any N-central version before 2026.3.

That matters because N-central is used by managed service providers. One compromised N-central server can mean hundreds of downstream customer networks exposed.

And the Tomcat bug?

Apache Tomcat flaw CVE-2026-34486, rated 7.5, is another incomplete fix, this time for an earlier critical bug about sensitive data not being encrypted properly. On July 30, researchers at Palo Alto Networks Unit 42 reported a Chinese-speaking group trying to plant reverse shells, small backdoors that call home to the attacker, on nine Tomcat servers.

The three flaws at a glance

Should ordinary people worry?

Not directly. These are enterprise products, not apps on your phone. But if the company holding your data runs any of them and drags its feet, your records could be exposed in a later breach notification. CISA has not said whether any of the three flaws are being used in ransomware, the kind of attack that locks up a company's files until it pays. The agency simply does not know yet.

For everyone else: patch by Friday.