The U.S. Cybersecurity and Infrastructure Security Agency pushed three more actively exploited flaws into its Known Exploited Vulnerabilities catalog on August 5, and the list reads like a tour of the threats defenders are fighting right now. A critical remote code execution bug in the open-source AI platform Langflow heads the group, joined by a Tomcat encryption flaw and two N-able N-central issues that were already under fire. Federal civilian agencies have until August 7 to patch, a tight deadline that hints at how hot these bugs are. The Hacker News first reported the additions.
The flaws CISA just flagged
Langflow leads the batch with CVE-2026-9198, a code injection hole that scores a brutal 9.8 on the CVSS scale. An unauthenticated attacker can reach full remote code execution on a default deployment of the low-code AI app builder. The vendor fixed it back in July with version 1.10.1, and IBM's advisory documents the details. The danger is that Langflow is exactly the kind of tool a busy data team spins up over lunch, exposes to the internet, and then forgets about. CISA's catalog entry is a signal that default installs are being target-tested right now.
Apache Tomcat lands at number two. CVE-2026-34486 scores 7.5 and lives in the cluster component known as the EncryptInterceptor, which is supposed to add pre-shared key encryption to messages traveling between cluster nodes. The missing encryption lets an attacker bypass that protection. Apache's advisory notes it was fixed in April across versions 11.0.21, 10.1.54, and 9.0.117, yet it is still being hit. Tomcat ships inside an enormous number of Java applications, so stale instances are common.
The third entry is different in shape. CVE-2026-18556 is the authentication bypass in N-able N-central that made news last week because the first patch was incomplete. N-able then shipped CVE-2026-18577, tracked separately and also at CVSS 8.2, and CISA placed that one in the catalog on Monday. Now both are confirmed exploited. The two entries put a clean warning on managed service providers, who run N-central as the administrative control plane for thousands of endpoints.
An AI agent picked its own targets
The most unsettling detail in CISA's batch is who appears to be doing the exploiting. CVE-2026-34486 in Tomcat has been tied to a Chinese-speaking threat actor who runs an autonomous hacking operation built around DeepSeek, using the Hermes Agent framework as the offensive operator. Palo Alto Networks Unit 42, which tracked the campaign, says the actor tried to hit more than 460 targets with a mix of fully autonomous and manual techniques.
Unit 42 noticed something unusual about the workflow. The actor let DeepSeek narrow the targeting scope, apparently to hold down the compute cost of running the AI. What used to take an analyst hundreds of hours, the researchers wrote, the system did in minutes while also managing its own resources. When an initial attempt to slip inside a Langflow installation failed because the configuration was too restrictive, the AI reportedly shifted gears on its own, hunted for other holes such as an n8n bug, and searched for a way in. The separation of chores mattered as much as the speed, because letting the model handle recon freed the human operator to focus on the parts brute automation does poorly.
The same CVE-2026-34486 shows up in a second operation that SOCRadar calls SNOWLIGHT, a China-nexus run aimed at government and commercial infrastructure in more than 100 countries. SOCRadar's analysis counts nine separate exploited flaws and 107 breached endpoints, including 16 takeovers of the root level of cPanel and WHM control panels and one Domain Admin compromise that went through ProxyShell.
Security teams read the pattern
SOCRadar found the evidence while digging through a staging server the attackers had left exposed. The box carried reconnaissance lists, eleven exploit chains, two classes of tunneling tool, and four command-and-control, remote-access-trojan, or malware families, plus a single verified SNOWLIGHT loader instance. Much of the toolkit was assembled from public GitHub proof-of-concept code, with one pirated commercial C2 product in the mix.
That reveals a spray-and-check way of working, SOCRadar argues, that has quietly become the default for China-nexus crews. Cheap automation, centralized staging, and a readiness to reuse older known bugs mean more attempts and more chances for one to slip through on the huge base of unpatched systems. The named malware component and the cracked Cobalt Strike-derived loader tell the same story as the eleven exploit chains: the operators favor scale and reuse over craft.
What defenders should do now
None of this is a mystery to treat. The Langflow patch landed in July, the Tomcat fixes shipped in April, and N-able has issued a revised patch explicitly because the first one was incomplete. The task is deployment and verification, then quarantine. CISA's order gives federal agencies until August 7, though the advice for everyone else is the same: patch or pull the box offline.
Mark any internet-exposed Langflow, Tomcat, or N-able instance as a priority. Confirm the version numbers against the fixed builds, and check that a remote system which should have encryption switched on actually has it. For managed service providers, the N-central question is now a customer conversation as much as a technical one, because a bug that compromises one N-central can reach every endpoint it manages.
Logs matter too. Teams that were already watching their edge devices should look for the fingerprints that these crews tend to leave behind: unexpected outbound connections to fresh domains, a N-central server talking to hosts it has no reason to reach, and Tomcat nodes that suddenly begin registering cluster messages from unknown peers. Unit 42's report notes that the actor favored centralized staging boxes, so a small number of transfers going to one unfamiliar address can be the tell long before a payload ever lands. The SNOWLIGHT infrastructure, by contrast, leaned on a wide mesh, which means defenders should also search for a pattern of many endpoints phoning the same coordinating server around the same hour.
Organizations without a full-time threat hunting crew still have a practical move. Both flaw families shipped patches weeks ago, so the honest question is not whether a fix exists but whether it is actually installed and verified. A short inventory of every Langflow, Tomcat, and N-central deployment, matched against the fixed version numbers, will close most of the gap in an afternoon. Where the asset cannot be patched right away, a firewall change to stop internet exposure buys time without pretending the bug has gone away.
The AI angle deserves a place in the plan. Enterprises are moving assistants into settings where they can research, insert proof of concept code, and move to a new target when one avenue closes, and the Tomcat campaign shows that is already happening in the wild and gaining. Admitting what the adversary has automated changes nothing about the fix; the response is the same hygiene that has always worked, applied faster and to a narrower, fully enumerated set of exposed surfaces.
Where this sits in the threat picture
The August 5 catalog update is among the most closely watched of the summer, partly because each of the three bugs maps to a different layer. Langflow is the AI supply chain, Tomcat is the web server backbone, and N-central is the MSP trust layer. A single CISA update rarely touches all three at once.
CISA's own alert lists the additions and the deadlines, and the Known Exploited Vulnerabilities catalog is worth treating as a to-do list rather than a headline. Every entry is evidence that the hole is being hit in production. The updated catalog also extends the N-able story that some readers already caught the week before on the fresh N-central patch.
Speculation about what the adversary will automate next is beside the point here. The concrete lesson has not changed shape. Patch the internet-exposed thing, believe the catalog, and assume the assistant that shrugs when it fails the first way will find another path on its own. The one that does it in minutes instead of hours has arrived, and it deserves a seat at the same planning table where your own defenders look at risk each week.
Related coverage
For the rest of the attack surface around this same corner of the internet, browse the Cybersecurity category and the IOT category. The fragment of the N-able story that broke the previous week is covered in our prior N-central post.
