CVE-2026-18577

CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog Affecting Langflow, Apache Tomcat and N-central

The U.S. Cybersecurity and Infrastructure Security Agency has added three known exploited vulnerabilities to its KEV catalog, urging federal agencies to apply patches by August 7, 2026. CVE-2026-9198 affects the AI application development platform Langflow and allows unauthenticated attackers to chain API calls, obtain tokens, and execute arbitrary code. CVE-2026-34486 impacts Apache Tomcat and enables bypass of the EncryptInterceptor, leaving cluster node communications unencrypted. CVE-2026-18556 in N-able N-central permits authentication bypass through alternate channels, while an incomplete fix introduced CVE-2026-18577, which was added to the catalog one day earlier. All three issues have confirmed exploitation in the wild.

N-able Releases Hotfix for Exploited N-central Authentication Bypass Flaw CVE-2026-18577

N-able has published a hotfix addressing a high-severity authentication bypass vulnerability in its N-central IT operations management platform. The flaw, tracked as CVE-2026-18577, allows attackers to bypass authentication through alternative paths or channels and potentially take over user accounts. It affects N-central 2026.1 and earlier versions and stems from an incomplete fix for the earlier CVE-2026-18556 issue. The vulnerability carries a CVSS v4.0 base score of 8.2 and is rated High severity. Exploitation has already been observed in the wild, with Indicators of Compromise including related IP addresses now publicly available. N-able released N-central 2026.3 Hotfix 1 (build 2026.3.1.7) on August 2, 2026, and urges customers to apply the update while also recommending agent updates where possible.