CVE-2026-9198/18556/34486: IBM, N-able, Tomcat — Active Exploits, Full Compromise Risk (August 2026)

CVE-2026-9198 / CVE-2026-18556 / CVE-2026-34486 — IBM Langflow, N-able N-central, Apache Tomcat

CISA has confirmed active exploitation of three high-severity vulnerabilities: CVE-2026-9198 (IBM Langflow), CVE-2026-18556 (N-able N-central), and CVE-2026-34486 (Apache Tomcat). Each flaw enables attackers to gain full control or exfiltrate sensitive data from affected systems. These vulnerabilities are now listed in the KEV Catalog and must be remediated by federal agencies under Binding Operational Directive 26-04. All three are being weaponized in the wild.

Attack Vector

Attackers are leveraging remote code execution and privilege escalation vectors. Exploitation requires network access to the affected service and may involve sending crafted requests or exploiting authentication bypasses. Once exploited, adversaries can execute arbitrary commands, deploy malware, or pivot further within the network. No specific IOCs are published, but exploitation aligns with MITRE tactics for initial access and defense evasion.

Who Is at Risk

Federal Civilian Executive Branch agencies running IBM Langflow, N-able N-central, or Apache Tomcat are directly impacted. Any deployment of these products—on-premises or cloud—should be considered at risk if not patched. The vulnerabilities threaten core government infrastructure and any organization using these platforms should assume exposure until remediation is confirmed.

Patch & Mitigate

• Patch: Apply vendor-released security updates for IBM Langflow, N-able N-central, and Apache Tomcat immediately. Federal agencies must comply with BOD 26-04 patch deadlines.
• Workaround: No reliable workarounds are documented. Disable exposed services if patching is delayed.
• Detect: Monitor for unusual process launches, unauthorized access attempts, and anomalous outbound connections from affected services. Review logs for suspicious requests targeting Langflow, N-central, or Tomcat endpoints.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit exposed services to gain a foothold.
• TA0005 — Defense Evasion: Post-exploitation, adversaries may disable logging or obfuscate activity to avoid detection.

Source: https://www.cisa.gov/news-events/alerts/2026/08/04/cisa-adds-three-known-exploited-vulnerabilities-catalog