Langflow first. Not because it has the flashiest CVE number, CVE-2026-9198, CVSS 9.8, but because half the security teams I talk to still treat AI workflow builders as someone else's science project. Between August 4 and 5, CISA shoved four actively exploited bugs into the Known Exploited Vulnerabilities catalog: that Langflow code-injection path, an N-able N-central auth bypass (CVE-2026-18556), a Tomcat EncryptInterceptor bypass (CVE-2026-34486), and on Wednesday a TeamCity deserialization flaw (CVE-2026-63077). Under BOD 26-04, federal civilian agencies get until August 7 for the Tuesday batch and August 8 for TeamCity. Three calendar days in the tightest case. SecurityWeek had the Tuesday three the same day CISA posted them.
Four products, four different messes
Langflow is an open-source visual builder for agent workflows, the demo someone stood up in March and never put in the CMDB. CVE-2026-9198 chains `/api/v1/auto_login`, which mints a SUPERUSER JWT for any network caller, into `/api/v1/validate/code`, which runs attacker Python through `exec()`. SentinelOne and IBM both describe that two-request path. No login. No user click. Just reachability to the HTTP API. Versions 1.0.0 through 1.10.0. Fix in 1.10.1 in July. PoC about a week after disclosure. KEV on August 4. If your org has been spinning up agent demos on shared cloud accounts, this is the week to ask which of those demos still have a public URL.
TeamCity is the familiar CI/CD shape. CVE-2026-63077 is unauthenticated deserialization through the agent polling protocol, rated 9.8, federal deadline August 8. Compromise one build server and you inherit every deploy credential that pipeline can touch. Tomcat's CVE-2026-34486 is narrower: it bypasses EncryptInterceptor, the optional cluster-traffic encryptor, after an earlier padding-oracle fix (CVE-2026-29146) left a gap Apache closed in April. Only matters if you actually run that interceptor. N-central is the "first patch wasn't enough" story. CVE-2026-18556 is an auth bypass via an alternate path. Attackers kept getting in at the end of July. N-able shipped a hotfix as CVE-2026-18577. Both are in KEV now. SecurityWeek has the original at CVSS 7.4.
None of these is a shiny consumer app. TeamCity builds. Tomcat runs Java. N-central is the RMM MSPs install with elevated reach across client networks, the same structural seat Kaseya VSA held in 2021. No public evidence of a thousand-customer ransomware cascade this week for N-central. The blast-radius math still explains why MSPs should care more than a 7.4 score suggests. And none of the four is a zero-day. Patches existed. Langflow's in July, Tomcat's in April, N-central's incomplete first fix earlier still. Patch lag, not missing patches, is what sorts winners from losers here.
Three-day deadlines and what Unit 42 actually said
Older CISA directives used flat clocks, two weeks, six months, without much interest in what the bug actually bought an attacker. BOD 26-04 weights automation potential, whether exploitation grants total control, and internet exposure. Hand someone an internet-facing box and the clock can shrink to three days. That's TeamCity this week. Agencies are also supposed to hunt for compromise before the patch, not just check a box that the RPM installed.
Still the routine track. Emergency Directives are the louder button. ED 26-03 against Cisco Catalyst SD-WAN in February shoved agencies through inventory-collect-patch-hunt with day-scale reporting. These four did not get that. Serious and confirmed, not "drop everything, Cisco-scale campaign."
CISA's KEV rows stay sparse on purpose: exploitation confirmed, no actor names, no victim lists. The attribution chatter around Tomcat comes from Palo Alto Unit 42's July 31 teardown of a Chinese-speaking operator (aliases knaithe / KnYuan) who wired DeepSeek into Hermes Agent, took orders over Telegram, and hunted targets via FOFA. Help Net Security and Deepwatch summarized the same report. Headlines have been sloppy with the table. Autonomous Hermes sessions tried a different Langflow CVE (CVE-2026-33017), not the KEV one, and failed when the required config wasn't on. An n8n chain failed where auth was required. Confirmed hits were separate manual work: Citrix NetScaler CVE-2026-3055 against three orgs, Marimo CVE-2026-39987 on eleven notebooks. Against Tomcat CVE-2026-34486, Unit 42 logged reverse-shell attempts on nine servers, attempts, not confirmed breaches. They only reconstructed the workflow because Hermes accidentally exposed the operator's home directory over HTTP. I've watched smaller stories get inflated into "AI bot owns the internet". CISA has not blessed any of this attribution inside the KEV entries themselves.
BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by CVEs listed in CISA's KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation.
A routine KEV week, if your inventory is honest
KEV sits around 1,660 entries. Four unrelated vendors in three days is a normal week, not a special one. Private-sector shops aren't bound by BOD 26-04. CISA still nudges everyone to use the same risk factors. Langflow on the public internet is the question I'd ask first, then rotate model keys after you clear 1.10.0. N-central needs a specific fixed build, not a vague "we're patched." Tomcat can wait until you confirm EncryptInterceptor clustering is even on. TeamCity anything reachable outside the build network earns the short clock whether or not you're a federal agency.
I've watched SOCs treat every Tuesday KEV dump like a board-level incident and then miss the one Langflow instance a product team stood up on a spare VM. The inventory problem is older than AI agent builders. The builders just make it worse because they look temporary until they aren't. If your CMDB has no row for "visual agent workflow tool someone demoed in March," this week's list is a reminder to go looking with something blunter than CVSS.
N-central deserves a second mention for MSPs specifically. The incomplete first patch is the kind of detail that gets lost when a ticket says "upgrade N-central" and closes. Verify the build string. Assume internet-reachable consoles are in scope until someone proves otherwise. There is still no public evidence of a Kaseya-scale cascade this week, I'm not inventing one, but the structural position is why a 7.4 gets more attention than the score alone suggests.
Teams that page everyone for every KEV addition burn out by October. Fold exploitability, total-control potential, and exposure into the SLA you already run, and read the catalog on a schedule instead of waiting for the next three-CVE headline to decide what matters. Three days is a federal clock. Your private-sector SLA can be longer. It should not be "whenever someone forwards the SecurityWeek link."
Attribution noise versus the patch clock
One more thing I want to leave on the table: the AI-agent angle around Unit 42's operator will keep getting rewritten into clickbait. The KEV deadlines will not. If you only have attention for one thread this week, take the inventory and the patch clock. The Hermes home-directory leak is a great research story. It is a terrible reason to delay upgrading TeamCity. Patch first. Argue about DeepSeek on Friday over coffee if you still care.
- Zero Trust
