CISA Adds Langflow, N-central & Apache Tomcat to Known Exploited Vulnerabilities Catalog — Patch Now
BizShield Editorial Team
Updated August 6, 2026
Quick Answer
On August 4, 2026, CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: IBM Langflow (CVE-2026-9198, CVSS 9.8 — unauthenticated remote code execution), N-able N-central (CVE-2026-18556, CVSS 8.2 — authentication bypass), and Apache Tomcat (CVE-2026-34486, CVSS 7.5 — missing encryption of sensitive data). Federal agencies were given until August 7, 2026 to patch. If your business — or your IT provider — runs any of these, patch immediately. N-central is especially urgent: it's a remote monitoring and management (RMM) platform many MSPs use to administer client networks, so one compromised N-central instance can expose every small business that MSP manages.
CISA confirmed active exploitation of three vulnerabilities on August 4, 2026, including a critical N-able N-central auth bypass that puts every business an MSP manages at risk. Here's what to check this week.
What CISA Added, and Why It's Not a Routine Alert
On August 4, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, giving U.S. federal civilian agencies until August 7 to patch. The KEV catalog is not a general vulnerability database — CISA only adds an entry once there's confirmed evidence of active exploitation in the wild. Every KEV addition means real attackers are using that specific flaw against real organizations right now, not that it's theoretically dangerous.
For small businesses, the federal deadline itself doesn't apply — but the signal behind it does. If CISA is telling the entire U.S. government to drop everything and patch within three days, that's the clearest possible indication of how attackers are prioritizing their targets this week. Treating a KEV addition as background noise is how businesses end up patching after the breach instead of before it.
The Three Vulnerabilities, Explained in Plain English
Each of these three flaws opens a different kind of door, and each is dangerous for a different type of business.
- Langflow — CVE-2026-9198 (CVSS 9.8): A code injection flaw in IBM Langflow, an open-source tool for building AI workflows, lets an attacker with no login credentials at all execute arbitrary code and gain superuser access on default installs (affects OSS versions 1.0.0–1.10.0). Any business experimenting with AI tooling that includes a self-hosted Langflow instance is exposed by default, out of the box.
- N-able N-central — CVE-2026-18556 (CVSS 8.2): An authentication bypass in N-central, a remote monitoring and management (RMM) platform. RMM software is what managed service providers (MSPs) use to remotely administer their clients' networks, install updates, and troubleshoot issues. An attacker who bypasses authentication on an MSP's N-central instance doesn't just compromise the MSP — they inherit the same remote access the MSP has into every client network it manages.
- Apache Tomcat — CVE-2026-34486 (CVSS 7.5): A missing-encryption flaw that exposes sensitive data in transit. Tomcat is one of the most widely deployed Java application servers in the world — it runs underneath countless internal business tools and customer-facing web apps that most people never realize are built on it.
The Real Risk for Small Business: The MSP Supply Chain
Of the three, the N-central authentication bypass deserves the most attention from small business owners specifically — not because it's the highest CVSS score, but because of who typically runs it. Small businesses that don't have in-house IT staff frequently outsource network management to an MSP, and RMM platforms like N-central are exactly how those MSPs do their job: one central console with remote access into every client's systems.
That efficiency is exactly what makes a compromised RMM platform so dangerous. It's not a hypothetical supply-chain risk — it's the same mechanism behind some of the most damaging MSP-targeted attacks of the past several years, where a single compromised management platform became a single point of entry into dozens or hundreds of otherwise well-defended small businesses simultaneously. If your business relies on an MSP and you've never asked what software they use to manage your network, this is a good week to ask.
What to Do This Week
You don't need a security team to act on this — you need about twenty minutes and the right questions.
- If you self-host Langflow: check your version immediately against IBM's advisory and patch or take the instance offline until you can.
- If you use an MSP: ask them directly, in writing, whether they use N-able N-central and whether the August 2026 patch has been applied.
- If you run custom Java web applications: ask your developer or hosting provider which Apache Tomcat version is in production and whether it's been patched against CVE-2026-34486.
- Either way: confirm auto-updates are enabled wherever the vendor supports it, so you're not relying on catching every CISA alert manually going forward.
Staying Ahead of the Next One
This is the pattern for practically every serious breach that starts with a software vulnerability rather than a phishing email: a patch existed, and it wasn't applied in time. CISA publishes every KEV catalog addition publicly and for free — subscribing to their alerts, or checking the catalog monthly as part of your own routine, costs nothing and closes the single biggest gap between 'a fix exists' and 'we applied it.'
If patch tracking isn't something anyone at your business currently owns, that's worth fixing before the next KEV addition, not after — our Cybersecurity Checklist for Small Business covers where patch management fits into a broader security routine.
Frequently Asked Questions
What does it mean when CISA adds a vulnerability to the KEV catalog?
CISA's Known Exploited Vulnerabilities catalog only lists flaws with confirmed evidence of active, real-world exploitation — it's not a theoretical risk list. When something lands in the KEV catalog, attackers are already using it. Federal civilian agencies are legally required to patch KEV entries within a set deadline (three days for this batch), and CISA recommends every organization, public or private, treat that same deadline as their own target.
I don't run Langflow, N-central, or Tomcat directly — do I need to care?
Possibly, indirectly. Apache Tomcat runs quietly underneath a huge number of Java-based business web applications, so you may be exposed without realizing a vendor's product is built on it — check with your software vendors. More urgently: if you outsource IT management to a managed service provider (MSP), ask them directly whether they use N-able N-central and whether it's patched. A compromised RMM platform gives attackers the same remote access your MSP uses to manage your systems.
How urgent is a CVSS 9.8 vulnerability like the Langflow flaw?
CVSS 9.8 is about as severe as the scoring system goes — it means the vulnerability requires no authentication, is easy to exploit, and grants full control (in this case, superuser access and arbitrary code execution) on default deployments. Combined with confirmed active exploitation, any business running affected Langflow OSS versions (1.0.0–1.10.0) should patch or take the instance offline immediately, not wait for a scheduled maintenance window.
How do I find out if my business is running a vulnerable version?
Check with whoever manages each system: your internal IT lead, your MSP, or the vendor directly. For self-hosted tools like Langflow, check the version in your admin panel against the vendor's advisory. For N-central, contact N-able or your MSP for confirmation the patch has been applied. For Tomcat, anyone running custom Java web applications should ask their developer or hosting provider which Tomcat version is in production.