N-able N-central Flaw Exploited in the Wild as CISA Adds Three to KEV Catalog

CISA added three actively exploited CVEs to its KEV list: a critical N-able N-central authentication bypass used in real intrusions against MSPs, a critical IBM Langflow unauthenticated code-injection (CVE-2026-9198), and an Apache Tomcat encryption weakness (CVE-2026-34486). Patches/hotfixes are available (apply N-central hotfix and Tomcat updates 11.0.21/10.1.54/9.0.117); defenders should hunt for rogue accounts (e.g., a “veeam” account), unexpected RMM installs, and IOCs such as an svchost.exe in a user Documents folder.