CISA's Latest KEV Additions Came With an AI Agent Attached
- 4 days ago
- 4 min read
CISA gave United States federal agencies until today to fix three vulnerabilities under active attack. One of them was being exploited by an AI agent operating with very little human direction. The patch deadline is the smaller half of that story.
What Happened
On 4 August, CISA added three flaws to its Known Exploited Vulnerabilities catalogue. The most severe is CVE-2026-9198, a code injection bug rated 9.8 in Langflow, IBM's visual framework for building AI agents. It lets an unauthenticated attacker chain two API endpoints to bypass login and run code on a default deployment. The second is CVE-2026-34486 in Apache Tomcat, rated 7.5, which bypasses EncryptInterceptor, the cluster component that encrypts messages passed between nodes; it stems from an incomplete fix for CVE-2026-29146. The third is CVE-2026-18556, an authentication bypass in N-able's N-central remote monitoring and management platform, rated 8.2, where the vendor's original patch also proved incomplete and a fresh identifier, CVE-2026-18577, followed. All three have fixes available: Langflow 1.10.1, Tomcat 11.0.21, 10.1.54 and 9.0.117, and an emergency N-central hotfix covering every version before 2026.3. Federal civilian agencies had until 7 August to apply them.
Why It Matters
Australian organisations sit squarely in the blast radius of at least two of these. N-central is a mainstay of managed service provider tooling, so a compromise there hands an attacker a route into every downstream client estate the platform touches, and a large share of Australian small and mid-sized businesses run their IT through an MSP. Tomcat underpins a great deal of Java infrastructure across Australian government and enterprise, while Langflow deployments have been quietly appearing inside development teams building AI features with little oversight.
There is a further detail worth sitting with. Palo Alto Networks Unit 42 attributed exploitation of the Tomcat flaw to a Chinese-speaking actor based in Zhuhai, operating under the aliases knaithe and KnYuan, who ran DeepSeek through the Hermes Agent framework as an offensive operator against internet-exposed devices. The actor attempted to exploit more than 460 targets using a mix of autonomous and manual techniques. When an early attempt against a Langflow flaw failed because the target environment was configured restrictively, the agent researched alternative routes on its own and settled on vulnerabilities in n8n instead.
This autonomous process of target identification, sampling and narrowing of scope is notable because the system executed hundreds of hours of manual targeting analysis in mere minutes, while also managing its own compute resources. — Palo Alto Networks Unit 42
What Security Teams Should Do Now
Patch now. Langflow 1.10.1 or later, Tomcat 11.0.21, 10.1.54 or 9.0.117, and N-able's emergency hotfix for all N-central versions before 2026.3.
Take Langflow off the public internet. It was never designed as an internet-facing service, and it has been exploited repeatedly through 2026.
Ask your MSP, in writing, when their N-central instance was patched and whether they have hunted for signs of administrative account takeover.
Hunt rather than assume. Working proof-of-concept code for CVE-2026-9198 circulated publicly in late July, so exposure predates the KEV listing by weeks. Review authentication logs, newly created admin accounts, and outbound connections from Tomcat cluster nodes.
Inventory your AI tooling. Langflow, n8n and comparable platforms usually arrive through a project team rather than procurement, which is why they rarely appear on the asset register.
Track the CISA KEV catalogue even though it carries no legal force here. It remains the closest thing to a free, curated feed of what is actually being exploited, and it should inform Australian cybersecurity patching priorities regardless of jurisdiction.
Aurian's Take
Attackers have used AI for a while now, mostly to write better phishing. What changed in this campaign is that an agent handled the reconnaissance and target-selection work that used to consume an operator's week, then made its own call to abandon a hardened target and pivot to a softer class of vulnerability. That compresses the interval between a proof-of-concept appearing in public and someone finding your exposed instance. Patch cycles built around a monthly maintenance window were already under strain. Against a system that can sift hundreds of targets before lunch, a monthly window stops being a control at all.
This is also why point-in-time compliance scanning keeps disappointing people. A scanner tells you a version number is wrong. It does not tell you that your Langflow instance is reachable from the internet, that the credentials it holds also work against your artefact repository, or that your MSP's monitoring agent offers a path into every server you own. Chaining is where the damage happens, and chaining is what a competent penetration testing engagement models. Aurian's work regularly finds that individually low-severity issues — an exposed internal tool, a reused service account, a monitoring agent carrying more privilege than anyone remembered granting — are the ones that combine into full compromise. Regular security assessment against the live estate, rather than the documented one, is the difference between knowing your exposure and hoping about it.
These three flaws will be patched, and three more will take their place next month. The question worth answering is whether your organisation would learn about its exposure from its own testing, or from an agent that got there first.
Comments