CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws

CISA has warned federal agencies to urgently mitigate three actively exploited vulnerabilities—IBM Langflow (CVE-2026-9198 and previously CVE-2026-0770), N-able N-central (CVE-2026-18576), and Apache Tomcat (CVE-2026-34486)—after public PoCs emerged and researchers reported attackers using the flaws to achieve remote code execution, hijack administrative accounts, and deploy reverse shells; vendors have issued patches and emergency hotfixes while CISA added the issues to its Known Exploited Vulnerabilities catalog and set a forced mitigation deadline.