CISA KEV Update: TeamCity, Langflow, N-central and Tomcat Bugs Need Fast Patching

CISA added another actively exploited vulnerability to its Known Exploited Vulnerabilities catalog on 5 August 2026: CVE-2026-63077, a JetBrains TeamCity deserialization of untrusted data vulnerability. The agency said KEV entries are added based on evidence of active exploitation.

The TeamCity addition followed three entries on 4 August: CVE-2026-9198, an IBM Langflow code injection vulnerability; CVE-2026-18556, an N-able N-central authentication bypass using an alternate path or channel; and CVE-2026-34486, an Apache Tomcat missing-encryption-of-sensitive-data vulnerability. CISA warns that these types of vulnerabilities are frequent attack vectors for malicious cyber actors.

The affected products sit in places where compromise can cascade. TeamCity is used in software build and deployment pipelines, Langflow can be part of AI and workflow tooling, N-central is remote monitoring and management software, and Tomcat often hosts web applications. If these systems are internet-facing or poorly segmented, exploitation can become a route into source code, credentials, customer systems or internal applications.

CISA's binding directive applies directly to U.S. federal civilian agencies, but the KEV catalog is useful far beyond government. It is a short list of vulnerabilities defenders should treat as already being used in the wild, not theoretical issues to patch eventually.

Inventory whether you run JetBrains TeamCity, IBM Langflow, N-able N-central or Apache Tomcat, especially on public IP addresses or in managed-service-provider environments. Apply vendor fixes or mitigations, then check logs and identity systems for signs of compromise before assuming patching alone closed the incident window.

For management tools and build systems, reduce internet exposure wherever possible. Put admin panels behind strong identity controls, restrict access to known networks, require phishing-resistant MFA, rotate secrets that may have been exposed, and review build agents or deployment tokens for unusual activity.

An enterprise VPN or private access gateway can help keep admin panels and management services off the open internet. That is especially relevant for remote monitoring tools, CI/CD dashboards and server administration interfaces that should not be reachable by everyone.

But a VPN is not a patch. It will not remove a vulnerable TeamCity, Langflow, N-central or Tomcat instance, and it will not tell you whether attackers already exploited the system before access was restricted. Consumer VPN apps are also not the same thing as enterprise access controls for servers.

The useful lesson for VPN Rocks readers is the distinction between privacy tools and exposure reduction. VPN access controls can reduce who can reach an admin surface, but exploited vulnerabilities still need patching, verification and incident-response discipline.

If you run a small business website or manage client systems, use the CISA KEV catalog as a weekly patch-priority input. Start with internet-facing tools, remote management platforms and anything that can touch builds, credentials or customer infrastructure.