On August 5, 2026, the U.S. Cybersecurity and Infrastructure Security Agency added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after confirming they are being actively used in real-world attacks. The most severe is a code injection flaw in Langflow (CVSS 9.8) that allows an attacker with no prior authentication to achieve full remote code execution on default deployments of the tool – a near worst-case scenario for any organization running it. It was patched in July 2026 in version 1.10.1, meaning organizations that haven’t updated are sitting on a live, exploitable gap.
The second flaw affects Apache Tomcat, involving missing encryption that lets an attacker bypass a cluster security component (EncryptInterceptor) meant to protect inter-node communication with a pre-shared key. This is a more subtle risk since it undermines an existing security control rather than being a straightforward RCE, which makes it easy to overlook in a patch review that only looks for “critical” labels.
For a CISO, KEV additions carry weight beyond the technical detail: U.S. federal agencies are required to remediate KEV-listed vulnerabilities within set deadlines, and many private-sector vulnerability management programs use the KEV list as a baseline for “must-patch-now” prioritization. This makes the update directly actionable for updating patch SLAs, vendor risk assessments (if any of these products are used by suppliers), and board-level vulnerability reporting.