CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog Affecting Langflow, Apache Tomcat and N-central
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, warning organizations to remediate them immediately.
The vulnerabilities added on August 4, 2026, are CVE-2026-9198, CVE-2026-34486, and CVE-2026-18556. Federal agencies have until August 7, 2026, to apply mitigations.
CVE-2026-9198 in Langflow
CVE-2026-9198 is a code injection flaw in Langflow, an open-source platform used to build AI applications. Attackers can chain API requests without authentication to obtain tokens and execute arbitrary code on affected systems.
CVE-2026-34486 in Apache Tomcat
CVE-2026-34486 affects Apache Tomcat. Successful exploitation allows attackers to bypass the EncryptInterceptor mechanism responsible for encrypting traffic between cluster nodes, potentially exposing data in transit.
CVE-2026-18556 and CVE-2026-18577 in N-central
CVE-2026-18556 impacts N-able N-central, an IT operations management platform. The flaw permits authentication bypass via alternate channels. An incomplete remediation for this issue led to the discovery of CVE-2026-18577, which was added to the KEV catalog on August 3, 2026.
Security teams are advised to review the official CISA KEV catalog and apply vendor patches without delay.
Related articles
VK Introduces Security Gate: Internal AppSec Platform for Code, Dependency and Container Security
VK has detailed its internal Security Gate platform, which combines SAST, SCA, secret detection and container scanning to identify security issues across more than 40,000 repositories. The system applies custom prioritization rules, dynamic metadata analysis and an LLM-based triage module called VK Triage to reduce false positives and focus developer attention on exploitable findings. Security Gate integrates directly with corporate GitLab for automatic project onboarding, badge reporting and merge-request checks via the Fast Scanner service. It also monitors open-source dependencies for protestware, malware and reachable vulnerable methods, while supporting a wide range of languages including Python, Go, Java and Swift. Additional features include Jira linking, cross-branch triage, SBOM export and automated alerts through VK WorkSpace bots.
2.2 Million Line Vulnerability Report: What Happens After Discovery and How to Turn Findings Into Action
A massive vulnerability scan produced an 1,819-page report and a 2.2-million-row Excel file that exceeded spreadsheet limits, highlighting the gap between detection and remediation. The article explains that finding vulnerabilities accounts for only 10 percent of the work, while the remaining 90 percent involves prioritization, remediation, verification, and ensuring issues do not reappear. Research from BI.ZONE, Sber, Qualys, Cyentia Institute, Kenna Security, and Hadrian shows that organizations can typically remediate only one in ten open vulnerabilities per month and that Time-to-Exploit has dropped dramatically, with many edge-device flaws exploited on the day of disclosure. The piece stresses that continuous scanning, full infrastructure coverage including shadow IT, and separate high-frequency perimeter scans are essential because 85 percent of KEV-vulnerable assets remain unpatched at disclosure time. It recommends replacing bulky reports with concise, role-specific registries that answer four questions: what to do, where to do it, by when, and the consequences of inaction. Three legitimate outcomes for every vulnerability are outlined: patching, compensating controls, or formal risk acceptance with defined review dates, while false positives such as orphaned OpenSSL libraries must be cleaned rather than ignored.
Prepare for Summer Vacation: Patch Tuesday Overlaps with Obon Holiday Week Raises Risks
As August approaches and organizations enter summer vacation season, many will face a challenging overlap between Microsoft's Patch Tuesday and Japan's Obon holiday week in 2026. System administrators and security teams are often unavailable during extended breaks, leading to slower detection, reporting, and remediation of threats. Ransomware campaigns frequently target periods such as evenings, weekends, and consecutive holidays when response times are delayed. Experts recommend completing software updates on servers, network devices, and endpoints before departure to close known vulnerabilities. Security product definition files should be refreshed, unused systems powered down after risk assessment, and basic controls verified in advance. The advisory from Security NEXT highlights that dispersed vacation schedules in some organizations still leave concentrated risk windows for others.
Critical Remote Code Execution Flaw Patched in Veeam ONE Backup Management Product
Veeam Software disclosed six vulnerabilities in its backup environment operations management product Veeam ONE on July 29, 2026. The most severe issue, tracked as CVE-2026-64633, permits unauthenticated remote code execution on the agent host and received a maximum CVSS v4.0 base score of 10.0, rated Critical. A second flaw, CVE-2026-58075, allows unauthenticated arbitrary file reads that can lead to local privilege escalation and carries a CVSS score of 8.7. The vendor released updated versions addressing all six issues in Veeam ONE 13.1. Security researchers and administrators are urged to apply the patches immediately given the high severity and lack of authentication requirements for the critical vulnerability.