The US Cybersecurity and Infrastructure Security Agency ( CISA ) added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) list on August 5, 2026 , citing evidence of active exploitation online. The vulnerabilities affect the Langflow platform , Apache Tomcat , and the N-able N-central remote management tool — three products widely used in enterprise environments. The deadline for federal agencies ( FCEBs ) to implement the necessary fixes was set for August 7, 2026 .
See also: CVE-2026-0770: CISA puts Langflow RCE in KEV and requests immediate patch by 24/7
The KEV reflects a broader trend this year: attackers are rapidly exploiting vulnerabilities in AI workflow platforms and remote management tools that are exposed online as soon as they become known. The fact that CISA included all three vulnerabilities at the same time underscores the urgency of the situation and the need for immediate action by organizations worldwide.
Langflow RCE: The vulnerability that AI exploits for attacks
The Langflow RCE vulnerability is perhaps the most concerning of the three. Trend Micro researchers identified the issue in the platform's validate endpoint and the way it handles the exec_globals parameter : the code processed input from untrusted sources in a way that allowed arbitrary code to be executed without authentication. The result was unauthenticated Remote Code Execution (RCE) with low exploit complexity, while in some cases root- level execution was reported .
The KEVIntel service recorded over 220 exploitation attempts from 64 unique IP addresses starting on June 27 , 2026. The affected versions are placed by some sources in the range 0.0.31 to 1.7.3 . Langflow 's architecture — with dynamic code execution, Python-based components, and API-driven flow manipulation — magnifies the risk, as even small authentication or input validation errors can lead to a complete server compromise.
Of particular concern is the attribution of the CVE-2026-34486 exploit to an autonomous AI- powered hacking campaign , organized by a Chinese-speaking threat actor operating under the aliases knaithe and KnYuan . This actor, based in Zhuhai , China, used DeepSeek via the Hermes Agent framework to target devices exposed online. When initial attempts to exploit another Langflow vulnerability ( CVE-2026-33017 , CVSS 9.8 ) failed due to restrictive settings, the AI agent conducted autonomous research to identify other high-value vulnerabilities, including flaws in n8n .
Palo Alto Networks Unit 42 reported: “This agent attempted to exploit over 460 targets, utilizing a combination of autonomous and manual techniques. Notably, the agent appeared to allow DeepSeek to limit the targeting range, likely to conserve AI computing resources.” This autonomous process of identifying, sampling, and narrowing the targeting range performed hundreds of hours of manual analysis in minutes.
See also: CVE-2026-46817: CISA requests immediate patch for active exploit in Oracle E-Business Suite
N-central and Langflow: The danger of incomplete patches
The vulnerability in N-able N-central has a unique characteristic that makes it extremely dangerous: it is a classic incomplete patch. The original authentication bypass vulnerability CVE-2026-18556 (CVSS score: 8.2) was patched, but the fix proved to be insufficient, forcing N-able to issue a new patch tracked as CVE-2026-18577 (CVSS score: 8.2). Both vulnerabilities are actively exploited by threat actors.
This “patch-after-the-patch” sequence is particularly worrisome for remote management platforms like N-central, as their breach could provide broad access to downstream systems. Defenders should assume that the first patch is insufficient until the vendor confirms that the latest fix fully addresses the issue. The Chinese-speaking threat actor mentioned above also conducted manual operations using known vulnerabilities in Citrix NetScaler (CVE-2026-3055), Marimo (CVE-2026-39987), Apache Tomcat (CVE-2026-34486), and IKE VPN (CVE-2026-33824) endpoints.
In previous campaigns targeting Langflow, researchers have documented extensive meta-exploitation: host identification, credential theft, environment variable harvesting, cloud metadata access, and secondary payloads. An attack chain combining a cross-tenant IDOR bug with a separate RCE, where attackers harvested flow IDs and reused them to gain access. These tactics highlight that exploiting Langflow doesn’t stop at the initial breach — attackers seek to extend their access to the entire cloud environment.
Langflow and N-central: Practical protection recommendations
Organizations using Langflow, N-central , or Apache Tomcat should take immediate action. First and foremost, it is essential to apply all patches for the three vulnerabilities added in KEV, with particular attention to N-central where it should be verified that the latest patch (CVE-2026-18577) has been installed and not just the first. Systems exposed to the internet — especially Langflow and remote management consoles — should be treated as a priority.
Limited exposure of AI workflow tools and admin consoles to trusted networks or VPN-only access is critical. The Langflow incidents clearly show that public exposure dramatically increases risk. In addition, security teams should look for signs of compromise by checking logs for suspicious requests to Langflow validation and flow building endpoints , as well as N-central administrative paths , especially from unusual IP addresses.
If a breach is suspected, immediate replacement of exposed credentials — cloud keys, API tokens, and service-account secrets — is absolutely necessary. For cases where immediate patching is not possible, mitigations such as WAF, endpoint detection, and aggressive network segmentation are recommended. CISA has already directed federal agencies to address these threats immediately, recognizing the serious risk they pose to critical infrastructure.
See also: CISA KEV: 4 Adobe, Joomla and Langflow vulnerabilities
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Overall, the simultaneous addition of three vulnerabilities to KEV — involving an AI platform , a web server, and a remote management tool — sends a clear message: attackers are exploiting increasingly complex attack chains, combining automation with AI and traditional hacking techniques . The speed with which the Chinese-speaking threat actor analyzed hundreds of targets in minutes using DeepSeek is a warning for the future of cybersecurity: defense must be as agile and automated as the attack.
