CISA Added Three Actively Exploited Vulnerabilities to Its KEV List

Security teams often have more vulnerabilities than they can patch immediately. CISA’s Known Exploited Vulnerabilities Catalog is meant to change the order of that queue by identifying flaws with evidence of active exploitation. On August 4, 2026, CISA added three entries: CVE-2026-9198: IBM Langflow code injection vulnerability. CVE-2026-18556: N-able N-central authentication bypass using an alternate path or channel. CVE-2026-34486: Apache Tomcat missing encryption of sensitive data vulnerability. The notice does not say that every installation is compromised. It says these vulnerabilities meet the catalog’s criteria for known exploitation and deserve rapid attention. A KEV entry is a prioritization signal The catalog is not a complete list of every dangerous vulnerability. It is a list of vulnerabilities that CISA says pose significant risk because threat actors are exploiting them. That distinction makes the list operationally useful. A high severity score describes what a flaw could allow. A KEV entry adds evidence about what attackers are doing in the real world. Defenders should consider both the vulnerability and the context of the affected asset: internet exposure, privileges, stored secrets, business role, and whether the system can be isolated while it is patched. Federal Civilian Executive Branch agencies have binding requirements under Binding Operational Directive 26-04. Private organizations are not automatically bound by those federal deadlines, but CISA encourages them to use the catalog for risk-based vulnerability management. Why the three products matter Langflow is associated with AI and workflow development, which makes its security relevant to teams building or testing model pipelines. N-central is a remote monitoring and management platform, placing it near the administrative systems that can manage other machines. Apache Tomcat is widely used as a Java application server, often behind business applications and APIs. Those roles create different risk paths. A code-injection flaw in an AI workflow tool may expose credentials or execution infrastructure. An authentication bypass in a management platform can provide a route into the systems it administers. A server-side data-protection weakness can expose information moving through an application stack. The specific remediation must come from each vendor’s advisory and the organization’s inventory. CISA’s entry is the alarm, not a substitute for identifying versions and applying the right fix. A disciplined response Organizations should: Search asset inventories, cloud accounts, DNS, vulnerability scanners, and vendor-managed environments for all three products. Confirm versions and whether systems are internet-facing or reachable through a trusted management network. Apply vendor patches or mitigations and record the result. Review authentication, administrator, application, and web-server logs for activity before remediation. Rotate credentials and tokens accessible from a potentially exposed system when the investigation warrants it. Add the assets to a recurring review so the fix is not forgotten after the catalog update leaves the news cycle. The practical lesson is simple: patching is only half of responding to a known-exploited vulnerability. The other half is finding the systems you did not know you had and checking what they could reach.