What Happened
On August 4, 2026, CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog, setting an August 7 remediation deadline for Federal Civilian Executive Branch agencies. All three are confirmed exploited in the wild, and all three are present in software categories widely deployed across Canadian enterprise and government environments.
CVE-2026-9198 — Langflow (CVSS 9.8)
This code injection flaw affects IBM Langflow OSS versions 1.0.0 through 1.10.0. The vulnerability chains two weaknesses: an unauthenticated endpoint that issued superuser bearer tokens to any network caller, and a code validation endpoint that executed arbitrary Python code. An attacker chains them by obtaining a superuser token, then submitting malicious Python to the validation endpoint, achieving full unauthenticated remote code execution on the Langflow server. The fix is version 1.10.1. Multiple proof-of-concept exploits appeared in late July 2026.
CVE-2026-34486 — Apache Tomcat (CVSS 7.5)
This flaw stems from an incomplete fix for CVE-2026-29146. When EncryptInterceptor decryption fails, Tomcat’s Tribes cluster communication module fails to discard the message. An unauthenticated attacker targeting the cluster port (default 4000) triggers Java deserialization and achieves remote code execution. Affected versions are 9.0.0.M1 through 9.0.116, 10.1.0-M1 through 10.1.53, and 11.0.0-M1 through 11.0.20. Patched versions are 9.0.117, 10.1.54, and 11.0.21, released in April 2026.
CVE-2026-18556 — N-able N-central (CVSS 8.2)
This is the original N-central authentication bypass vulnerability that preceded the patch-bypass chain (CVE-2026-18577) first reported August 2-3. CISA’s addition of the original CVE formalises its status as actively exploited and brings it under BOD 22-01 obligations for federal agencies.
Source: BleepingComputer | The Hacker News | SecurityWeek
Why This Matters for Canadian Organizations
Each of these three platforms has a significant Canadian footprint. Langflow is used by Canadian AI development teams, fintech startups, and enterprise data science groups building AI workflows and LLM-powered applications. Apache Tomcat is one of the most widely deployed Java application servers in the country, present in government portals, healthcare systems, financial applications, and university infrastructure. N-able N-central is an RMM platform used by managed service providers who collectively manage thousands of downstream Canadian client environments.
Exploitation of any of these three vulnerabilities in a Canadian context triggers OSFI Guideline B-13 obligations for federally regulated financial institutions, and PIPEDA breach notification requirements if personal information is accessed. For organizations using N-central through an MSP, the MSP’s compromise is effectively your compromise for PIPEDA purposes — the accountability obligation rests with the organization whose data is at risk, not the service provider that was breached.
What to Do
The August 7 federal deadline applies to US agencies, but it represents a strong signal for Canadian operators. All three patches have been available for weeks; exploitation being confirmed and catalogued by CISA means threat actors have working capabilities and are using them.
- Langflow: Update to version 1.10.1 immediately. Audit Langflow server logs for anomalous superuser token issuance and code validation endpoint calls since July 2026. Rotate any API keys stored in or accessible from the Langflow environment.
- Apache Tomcat: Update to 9.0.117, 10.1.54, or 11.0.21 depending on your deployment. If clustering is enabled, restrict access to the cluster communication port (4000) at the network layer. Review deserialization controls in your Tomcat configuration.
- N-able N-central: Apply hotfix 2026.3.1.7 on all on-premises instances immediately if you have not already done so. Audit Take Control logs and check for cloudflared processes on managed endpoints. Contact your MSP to confirm their remediation status and request evidence of patching.
