On February 11, 2025, CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog. Within 48 hours, security researchers recorded 650 exploitation attempts from 244 unique IP addresses targeting this critical remote code execution flaw in Langflow, an open-source AI workflow platform. The vulnerability carries a CVSS score of 9.8 and allows attackers full remote code execution without authentication.
Two additional vulnerabilities joined the catalog simultaneously: CVE-2026-34486, a missing encryption flaw in Apache Tomcat, and an authentication bypass in N-able N-central. The Tomcat vulnerability is notable for its link to an AI-enabled autonomous hacking campaign attributed to Chinese-speaking threat actors using the DeepSeek framework.
Timeline
February 11, 2025: CISA adds three vulnerabilities to the KEV catalog:
- CVE-2026-9198 (Langflow RCE, CVSS 9.8)
- CVE-2026-34486 (Apache Tomcat missing encryption)
- Authentication bypass in N-able N-central
Within 48 hours: Researchers observe 650 exploitation attempts against the Langflow vulnerability from 244 distinct attacker IPs.
Ongoing: Security teams report reconnaissance activity consistent with AI-driven automation patterns, including rapid sequential scanning across IP ranges and adaptive exploitation attempts that modify payloads based on initial responses.
Which Controls Failed
The Langflow incidents reveal three control failures:
Missing input validation. The RCE vulnerability exists because Langflow didn't properly sanitize user-supplied data before processing it. This violates OWASP ASVS v4.0.3 Requirement 5.1.1, which mandates that applications validate all untrusted data against a defined schema.
Inadequate authentication boundaries. Attackers reached the vulnerable endpoint without authentication. Your API gateway should enforce authentication before any request reaches application logic. This maps to NIST 800-53 Rev 5 control AC-3 (Access Enforcement).
Delayed patch deployment. Organizations running Langflow in production didn't have processes to identify and patch critical vulnerabilities within the CISA-mandated 21-day window. Federal agencies must patch KEV-listed vulnerabilities within three weeks per BOD 22-01, but you should aim for 72 hours on critical RCE flaws.
The Tomcat case adds a fourth failure: unencrypted credential transmission. The missing encryption vulnerability allowed threat actors to intercept authentication tokens. This directly violates PCI DSS v4.0.1 Requirement 4.2.1, which requires strong cryptography for transmission of cardholder data and authentication credentials across public networks.
What Standards Require
PCI DSS v4.0.1 Requirement 6.3.2 states: "Security vulnerabilities are identified using industry-recognized sources for security vulnerability information, including alerts from international and national computer emergency response teams." CISA's KEV catalog qualifies as such a source. If you process payment card data and run any of these three products, you're required to have documented this vulnerability and initiated remediation.
ISO/IEC 27001:2022 Control 8.8 (Management of technical vulnerabilities) requires you to maintain an inventory of assets, identify technical vulnerabilities, evaluate exposure, and take appropriate action. The 650 exploitation attempts against Langflow demonstrate that "appropriate action" means patching within days, not weeks.
SOC 2 Type II CC7.1 (Common Criteria 7.1) addresses system monitoring. Your monitoring should have detected the reconnaissance patterns preceding these exploitation attempts. AI-driven campaigns generate distinctive traffic signatures: rapid sequential requests with programmatically varied payloads, automated retry logic, and correlation between scanning and exploitation phases.
NIST CSF v2.0 function PR.IP-12 (A vulnerability management plan is developed and implemented) requires you to prioritize vulnerabilities based on risk. KEV inclusion is your clearest signal to escalate priority. If you're still using CVSS scores alone to prioritize patches, you're ignoring real-world exploitation data.
What AI Changes About Vulnerability Response
The DeepSeek-linked campaign against Apache Tomcat demonstrates a shift in attacker capabilities. Traditional automated scanning follows predictable patterns: sequential port scans, standard exploit payloads, fixed retry intervals. AI-enabled reconnaissance adapts in real time.
Your IDS signatures won't catch this. The attack traffic looks like legitimate application testing because the AI framework learns from failed attempts and modifies subsequent requests. It identifies the application stack, tests for common misconfigurations, and selects exploitation techniques based on observed responses.
This changes your detection strategy. Instead of signature-based blocking, you need behavioral analysis that identifies:
- Rapid learning patterns (failed requests followed by increasingly targeted attempts)
- Correlation between reconnaissance and exploitation from the same source
- Automated credential stuffing with adaptive timing to evade rate limits
Action Items
Immediate (this week):
Query your asset inventory for Langflow, Apache Tomcat, and N-able N-central instances. If you don't have automated asset discovery running continuously, you can't respond to KEV additions within acceptable timeframes.
Subscribe to CISA's KEV catalog RSS feed and route alerts directly to your security operations channel. Don't rely on weekly vulnerability meetings to surface these.
Patch the three vulnerabilities if you're running affected versions. Langflow requires immediate attention given the 650 recorded exploitation attempts.
This month:
Implement behavioral analysis in your SIEM to detect AI-driven reconnaissance. Look for patterns where failed authentication attempts are followed by modified requests that probe different endpoints or vary payload structure.
Review your vulnerability SLA policy. If you're treating all CVSS 9+ vulnerabilities identically, you're misallocating resources. KEV-listed flaws need a separate, faster track.
Test your authentication enforcement at the API gateway level. The Langflow RCE shouldn't be reachable without valid credentials, even if the application code has an input validation flaw.
This quarter:
Map your current vulnerability management process against NIST CSF v2.0 PR.IP-12. Document how you're incorporating threat intelligence (like KEV) into prioritization decisions. Your auditor will ask for this evidence.
Deploy honeypots that mimic AI workflow platforms and RPA tools. These are emerging targets for AI-enabled campaigns. You want early warning when threat actors start reconnaissance against this application category in your environment.
Review encryption implementation across all web applications. The Tomcat vulnerability exists because someone configured the server without mandatory TLS for authentication endpoints. Your deployment pipeline should fail builds that expose authentication over unencrypted channels.
The 244 unique attacker IPs targeting Langflow represent distributed, automated exploitation. You can't manually review firewall logs fast enough to spot these campaigns before they succeed. Your response time needs to match attacker automation speed, which means integrating KEV alerts directly into your patch deployment workflow.
