CISA Warns of Active Exploitation in Critical Software Vulnerabilities

WASHINGTON — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert on Wednesday, warning that threat actors are actively exploiting three critical software vulnerabilities to gain unauthorized access to systems across the United States.

The agency identified specific flaws in Langflow Open Source Software (OSS), N-able's N-central management platform, and Apache Tomcat. These weaknesses allow malicious actors to execute remote code, bypass authentication protocols, and seize administrative control over targeted networks without valid credentials.

CISA stated that the exploitation of these vulnerabilities poses an immediate risk to federal agencies, critical infrastructure operators, and private sector entities relying on the affected software stacks. The agency emphasized that attackers are leveraging these gaps to establish persistent footholds within victim environments, potentially enabling data exfiltration or further lateral movement across internal networks.

The vulnerability in Langflow OSS affects a popular open-source tool used for building large language model applications. Separately, flaws in N-able's N-central software compromise the remote monitoring and management capabilities essential to many managed service providers. The third identified weakness targets Apache Tomcat, a widely deployed Java servlet container that powers countless web applications globally.

IBM has released security advisories regarding its own exposure related to these components, urging customers to apply patches immediately if they utilize affected versions of N-able or Langflow products integrated into their infrastructure. Similarly, the development teams behind Apache Tomcat have acknowledged the severity of the issue and are coordinating with users on mitigation strategies.

CISA advised organizations to verify whether they are running vulnerable versions of these applications and to implement compensating controls if immediate patching is not feasible. The agency recommended isolating affected systems from public networks, disabling unnecessary services, and monitoring for signs of unauthorized access or anomalous administrative activity.

The alert comes as cybersecurity agencies have increasingly tracked a surge in targeted attacks exploiting unpatched software flaws before vendors can release fixes. While CISA has confirmed active exploitation, the full scope of compromised organizations remains unclear. It is not yet known whether any specific critical infrastructure sectors have already suffered successful breaches linked to these vulnerabilities.

Security researchers are currently analyzing traffic patterns associated with the exploits to determine if a single threat group or multiple independent actors are responsible for the campaigns. As developers race to finalize and distribute patches, CISA warned that attackers may continue scanning for vulnerable systems in the coming days. Organizations facing delays in patch deployment remain at elevated risk until comprehensive updates are applied across their environments.