VulnerabilityBleeping Computer
9.8 — CRITICAL
CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws
The U.S. Cybersecurity and Infrastructure Security Agency is giving federal agencies three days to mitigate vulnerabilities in IBM Langflow, N-central, and Apache Tomcat, all actively exploited. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
Threat actors are exploiting multiple vulnerabilities in IBM Langflow, N-central, and Apache Tomcat, allowing them to execute remote code execution with root privileges, hijack administrative accounts without authentication, or bypass encryption of sensitive data.
⚙️Technical Details
💥Impact Assessment
Severity: Critical
🛡️Recommended Actions
1Apply available mitigations for Langflow, N-central, and Apache Tomcat by the end of Friday, July 7th.
2Install emergency hotfixes for N-central as soon as possible.
3Upgrade to version 11.0.21, 10.1.54 or 9.0.117 of Apache Tomcat
📦Affected Products
Langflow LangflowApache TomcatRedhat Enterprise LinuxRedhat Enterprise Linux ElsRedhat Enterprise Linux EusRedhat Enterprise Linux TusRedhat Enterprise Linux Update Services For Sap SolutionsRedhat Jboss Web ServerLangflowN-central
🔐NVD Verified DataVERIFIED
CVE-2026-9198 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-94
Affected Products (CPE)
Langflow Langflow
CVE-2026-0770 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-829
Affected Products (CPE)
Langflow Langflow
CVE-2026-34486 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-311CWE-807
Affected Products (CPE)
Apache TomcatRedhat Enterprise LinuxRedhat Enterprise Linux ElsRedhat Enterprise Linux EusRedhat Enterprise Linux Tus
CVE-2026-29146 ↗CVSS 7.5 — HIGH
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NWeaknesses
CWE-1240CWE-209CWE-642
Affected Products (CPE)
Apache Tomcat
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.