CISA has added three vulnerabilities to its Known Exploited Vulnerabilities catalog citing active exploitation, including a critical code-injection flaw in the open-source AI platform Langflow and an encryption-bypass issue in Apache Tomcat. The agency has ordered federal civilian executive branch agencies to patch the affected products by an early-August deadline, and researchers have tied exploitation of the Tomcat flaw to an AI-enabled autonomous hacking campaign.
The Three KEV Additions: Langflow, Tomcat, and N-able N-central
The catalog additions cover CVE-2026-9198, a CVSS 9.8 code-injection vulnerability in Langflow that enables unauthenticated remote code execution on default deployments, and CVE-2026-34486, a CVSS 7.5 flaw in Apache Tomcat involving missing encryption of sensitive data that allows an EncryptInterceptor bypass. A third addition, CVE-2026-18556, an N-able N-central authentication bypass with a CVSS score of 8.2, was already covered in prior reporting on the remote management platform and is included as context for the broader catalog update.
Patch Versions and the Federal Deadline
Patches are available for the affected products: Langflow fixed the issue in version 1.10.1, and Apache Tomcat addressed the flaw in releases 11.0.21, 10.1.54, and 9.0.117. CISA has required federal civilian executive branch agencies to apply the fixes by the stated deadline, while all other organizations are urged to treat the actively exploited flaws as urgent.
The Langflow Code-Injection Mechanics Behind CVE-2026-9198
CVE-2026-9198 enables unauthenticated remote code execution on default Langflow deployments because the code-injection flaw is reachable without any prior authentication or configuration change. Langflow, an open-source framework for building AI applications, is widely deployed and has been targeted before, which makes a default-reachable RCE especially concerning for organizations running it exposed to the network. The fix in version 1.10.1 closes the injection point, and the CVSS 9.8 rating reflects both the ease of access and the full-system impact of successful exploitation.
The DeepSeek-Driven Autonomous Campaign Behind the Tomcat Exploitation
Security researchers at Unit 42 attributed exploitation of the Tomcat vulnerability to an AI-enabled autonomous hacking campaign run by a Chinese-speaking actor using the aliases knaithe and KnYuan, operating from Zhuhai, China. The actor used DeepSeek through the Hermes Agent framework to target internet-exposed devices, according to the research.
Autonomous Vulnerability Research and a Broader Manual Targeting Footprint
The AI agent attempted to exploit a separate Langflow flaw, CVE-2026-33017, also rated CVSS 9.8, and when it was blocked by restrictive environments it autonomously researched other higher-value vulnerabilities, including flaws in n8n. The same actor also conducted manual operations using known vulnerabilities in Citrix NetScaler, Marimo, Apache Tomcat, and IKE VPN endpoints, and attempted to exploit more than 460 targets using a mix of autonomous and manual techniques. Unit 42 reported that the actor allowed DeepSeek to narrow the targeting scope to conserve AI compute, executing what the researchers described as hundreds of hours of manual targeting analysis in mere minutes.
Why the KEV Additions and AI-Driven Targeting Matter
Langflow has been repeatedly weaponized as a widely used open-source AI application builder, while Tomcat is ubiquitous middleware running behind countless web applications, which makes the combination of active exploitation and autonomous targeting a direct risk to broad internet-exposed deployments. The catalog update is the formal signal that both flaws are being used in the wild, which typically precedes a spike in scanning and exploitation attempts.
The connection between a Chinese-speaking operator and an autonomous AI campaign raises the stakes for defenders, because an agent-driven targeting loop can scale reconnaissance and exploitation attempts across hundreds of hosts without human oversight. The pattern also points toward a new phase in offensive tooling, where the bottleneck is no longer analyst time but the operator’s willingness to let the agent run.
For federal agencies the path is clear: apply the patches before the deadline. For private organizations running Langflow or Tomcat on internet-facing systems, the same urgency applies, since the KEV designation reflects confirmed exploitation rather than a theoretical risk. The broader lesson from the campaign is that defensive monitoring now has to account for autonomous actors that can probe an environment continuously and adapt when a particular exploit path is closed.
The Unit 42 research also documents how AI-assisted targeting changes the reconnaissance phase of an attack. When an agent can condense what would normally be hundreds of hours of manual analysis into minutes, the window between a new vulnerability being disclosed and it being used against a specific organization can shrink dramatically. For defenders that have relied on patch timeframes measured in days, the autonomous targeting capability documented in this campaign argues for treating every cataloged, exploited vulnerability as an immediate, same-day remediation priority, particularly on middleware like Tomcat that sits in the request path of nearly every web application.
