CISA KEV Alert: Active Exploitation of Langflow, N-able N-central, and Apache Tomcat — 72-Hour Detection and Remediation Guide

When CISA adds vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog and slaps a three-day remediation deadline on federal agencies under Binding Operational Directive 22-01, that is not routine hygiene — that is a flare gun. Short-fuse deadlines are reserved for flaws where exploitation is confirmed, exploitation tooling is mature, and adversaries are moving faster than enterprise patch cycles. This week, three products landed in that category: IBM Langflow (an AI workflow/orchestration framework increasingly deployed in enterprise AI pipelines), N-able N-central (an RMM platform with deep reach into managed endpoints), and Apache Tomcat (the ubiquitous Java servlet container underpinning thousands of business applications).

Every one of these targets sits in a privileged position. Langflow servers hold API keys and credentials for LLM providers and internal data sources. N-central is, by design, a remote management and monitoring platform with pre-authorized administrative access to every managed endpoint in your estate — compromise the RMM and you inherit the fleet. Tomcat fronts web applications that process sensitive transactions and frequently run with excessive privilege. Active exploitation of any one of these is an incident; exploitation of all three simultaneously tells you adversaries are hunting the connective tissue of enterprise environments.

If you run any of these products, treat this as a patch-now-and-hunt-back event: apply fixes, then assume a dwell window existed and hunt for compromise predating the patch.

Technical Analysis

Affected Products

All three flaws share a common exploitation profile from a defender's standpoint: they are network-reachable, they target services frequently exposed to the internet or broad internal segments, and successful exploitation yields code execution in the context of the service account — which is often SYSTEM, root, or an over-privileged service principal.

How These Attacks Look From the Defender's Side

While the specific vulnerability mechanics differ per product, the observable post-exploitation behavior converges on a well-understood pattern:

1. Initial access arrives as crafted HTTP requests against the service's web listener. For Tomcat, watch for malformed or unusual request patterns targeting deployed applications, including path-manipulation sequences and suspicious file-upload or session-related requests. For Langflow, attacker traffic targets API routes that accept and validate/execute user-supplied code. For N-central, requests target the management console's authentication and session-handling logic.
2. Execution pivot: the service process spawns child processes it never spawns in normal operation. Tomcat's java.exe (or the JVM running your application) suddenly launches cmd.exe, powershell.exe, /bin/sh, or /bin/bash. The Python process hosting Langflow spawns shells or interpreters with attacker-supplied arguments. N-central's Java service spawns unexpected command interpreters outside of scheduled job windows.
3. Persistence and staging: web shells dropped into Tomcat's webapps directory, new scheduled tasks or services, and outbound connections from the server process to rare external destinations.

That convergence is your detection opportunity: you don't need to signature the exploit payload itself if you reliably alarm on the service process spawning command interpreters and on files appearing in web application directories.

Exploitation Status

• Confirmed active exploitation in the wild — this is the precondition for KEV inclusion.
• CISA KEV: all three vulnerabilities are listed in the Known Exploited Vulnerabilities catalog.
• Federal deadline: agencies have three days from the KEV listing to apply mitigations per BOD 22-01. Private-sector organizations should adopt the same urgency — the three-day clock reflects observed adversary velocity, not bureaucratic conservatism.

Assume public or semi-public exploit tooling exists and that internet-wide scanning for these services is underway. Any instance reachable from the internet should be treated as potentially already probed.

Detection & Response

The detections below target the post-exploitation behaviors common to all three attack paths. They are deliberately scoped to high-fidelity signals — a servlet container or Python application server spawning an interactive shell is not normal behavior in any environment I've operated in.

Sigma Rules

---
title: Web or Application Server Process Spawning Shell — Tomcat Langflow N-central
tid: 8f2a1c4e-6b3d-4a7e-9c1f-2d5e8a9b0c1d
status: experimental
description: Detects Java (Tomcat/N-central) or Python (Langflow) service processes spawning command interpreters, consistent with post-exploitation of actively exploited web-facing vulnerabilities added to CISA KEV.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
      - '\python.exe'
      - '\pythonw.exe'
      - '\uvicorn.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - N-central legitimately executes scripts via its automation engine — baseline scheduled job activity and alert on executions outside maintenance windows or with unusual command lines
  - Tomcat applications with embedded scripting features
level: high
---
title: Web Shell Dropped in Tomcat Webapps or Upload Directories
id: 3b7e9f2a-1c5d-4e8a-b6f0-9a2c4d7e1f3a
status: experimental
description: Detects creation of JSP/JSPX files in Tomcat web application directories, a hallmark of web shell deployment following Tomcat exploitation.
references:
  - https://attack.mitre.org/techniques/T1505/003/
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\webapps\'
      - '\work\Catalina\'
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.war'
  filter_deployer:
    Image|endswith:
      - '\java.exe'
      - '\Tomcat9.exe'
      - '\Tomcat10.exe'
      - '\tomcat.exe'
    CommandLine|contains: 'deploy'
  condition: selection and not filter_deployer
falsepositives:
  - CI/CD pipelines deploying applications — restrict alerts to write events from unexpected accounts or outside deployment windows
level: high
---
title: Linux Application Server Spawning Interactive Shell
tid: 5d1f8a3c-2e7b-4c9d-a1e6-7f3b9c5d2e4a
status: experimental
description: Detects java or python application server processes on Linux spawning shells or download utilities, consistent with exploitation of Tomcat or Langflow services.
references:
  - https://attack.mitre.org/techniques/T1059/004/
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
      - '/python'
      - '/python3'
      - '/uvicorn'
      - '/gunicorn'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Application health checks and init scripts — baseline per host and alert on first-seen parent/child pairs
level: high

KQL — Microsoft Sentinel / Defender

This query hunts for the child-process pivot across your Windows estate, plus outbound connections from the service processes themselves — a strong signal of command-and-control or payload staging after exploitation.

// Hunt: Tomcat/N-central/Langflow service processes spawning shells or LOLBins
let ParentProcs = dynamic(["java.exe","javaw.exe","python.exe","pythonw.exe","uvicorn.exe"]);
let ChildProcs = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","certutil.exe","bitsadmin.exe","whoami.exe","net.exe","nltest.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (ParentProcs)
| where FileName in~ (ChildProcs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, InitiatingProcessRemoteSessionType
| order by TimeGenerated desc;
// Companion hunt: outbound connections FROM java/python server processes to rare destinations
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (dynamic(["java.exe","javaw.exe","python.exe","uvicorn.exe"]))
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort
| where ConnectionCount < 50  // low-and-slow beaconing
| order by FirstSeen asc;

For Linux Tomcat/Langflow hosts ingested via Syslog/CEF, correlate Syslog process-audit records (auditd EXECVE events) where the parent is java or python3 and the child is a shell — the same parent/child logic as the Sigma rule above.

Velociraptor VQL — Endpoint Hunt

Use this artifact across servers running Tomcat, N-central, or Langflow to surface both the process pivot and web shell artifacts in one sweep.

-- Hunt: Post-exploitation indicators on Tomcat / N-central / Langflow servers
-- Part 1: Suspicious child processes of service binaries
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)^(cmd|powershell|pwsh|mshta|rundll32|certutil)\.exe$'
  AND Ppid IN (
      SELECT Pid FROM pslist()
      WHERE Name =~ '(?i)^(java|javaw|python|pythonw|uvicorn)\.exe$'
  )

-- Part 2: Recently created web shell candidates in Tomcat directories
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs='C:/**/webapps/**/*.jsp')
WHERE Btime > now() - 1209600
ORDER BY Btime DESC

For Linux targets, run the equivalent with glob(globs='/**/webapps/**/*.jsp') and combine with netstat() to review outbound sessions held by java/python PIDs.

Version Verification and Exposure-Reduction Script

Use this to inventory exposure, verify service status, and apply compensating controls on Tomcat hosts while patching is scheduled. Adapt the paths for your Tomcat version (9/10/10.1).

#!/bin/bash
# Tomcat exposure triage and hardening — run on each Tomcat host
# 1. Identify running Tomcat version and JVM
echo "=== Tomcat Version ==="
find /opt /usr/share /var/lib -maxdepth 4 -name 'catalina.jar' 2>/dev/null | while read jar; do
  unzip -p "$jar" org/apache/catalina/util/ServerInfo.properties 2>/dev/null | grep 'server.info'
done

# 2. List deployed web applications and recently modified JSP files (potential web shells)
echo "=== Recently modified JSP files (last 14 days) ==="
find / -path '*/webapps/*' -name '*.jsp' -mtime -14 -ls 2>/dev/null

# 3. Check for unexpected child processes of the JVM
echo "=== JVM child processes ==="
for pid in $(pgrep -f 'catalina'); do
  ps --ppid "$pid" -o pid,ppid,user,cmd
  echo "--- Outbound connections from PID $pid ---"
  ss -tnp | grep "pid=$pid"
done

# 4. Compensating control: restrict connector binding to localhost or approved
#    subnets until patched (edit conf/server.xml Connector address= attribute)
#    and/or apply firewall rules:
# iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
# iptables -A INPUT -p tcp --dport 8080 -j DROP

echo "=== Review output, then patch per Apache Tomcat security advisories: https://tomcat.apache.org/security.html ==="

# Windows triage for N-central and Tomcat-on-Windows hosts
# 1. Identify installed versions
Get-CimInstance Win32_Product -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match 'N-central|Tomcat' } |
  Select-Object Name, Version, InstallDate

# 2. Recent process pivots from service binaries (last 14 days)
$start = (Get-Date).AddDays(-14)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$start} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Creator Process Name.*(java|python)' -and
                 $_.Message -match 'New Process Name.*(cmd|powershell|mshta|rundll32|certutil)' } |
  Select-Object TimeCreated, Message | Format-List

# 3. Web shell sweep in Tomcat directories
Get-ChildItem -Path 'C:\' -Recurse -Include *.jsp -ErrorAction SilentlyContinue |
  Where-Object { $_.FullName -match 'webapps' -and $_.CreationTime -gt $start } |
  Select-Object FullName, CreationTime, LastWriteTime

# 4. Outbound connections held by service processes
Get-NetTCPConnection -State Established |
  Where-Object { (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name -match 'java|python' } |
  Select-Object LocalPort, RemoteAddress, RemotePort, OwningProcess

Remediation

Immediate (within the CISA 72-hour window — adopt the federal deadline as your own):

1. Patch all three products to vendor-fixed releases immediately. Pull the current patched builds directly from the vendors:
   • Langflow: upgrade to the latest release from the official repository/releases page and review IBM/DataStax security guidance.
   • N-able N-central: apply the hotfix per the N-able security advisories at https://www.n-able.com/security-advisories (verify both the server and agent components).
   • Apache Tomcat: upgrade to the current fixed release line for your major version per https://tomcat.apache.org/security.html — do not assume your distribution's backported package is current; verify the actual running version with the script above.
2. Inventory internet exposure. Query your external attack surface management tooling (or Shodan/Censys data) for Langflow, N-central, and Tomcat listeners. Any instance reachable from the internet that cannot be patched inside 72 hours must be pulled behind a VPN, WAF with virtual patching rules, or access control list restricting source IPs.
3. Remove standing privilege. Langflow deployments frequently store LLM API keys, database credentials, and OAuth tokens in environment variables or flow configurations. If the instance was internet-reachable before patching, rotate every credential it can reach — assume the config store was read.

Hunt back (assume pre-patch dwell time):

4. Run the KQL and VQL hunts above across a lookback window of at least 14 days (30 if telemetry retention allows). Prioritize any host that was internet-exposed and unpatched.
5. For N-central specifically: audit administrative user accounts, API tokens, and automation policies/scripts created or modified in the past 30 days. RMM compromise is a springboard — check for pushed scripts or software deployments you didn't authorize, on every managed endpoint.
6. For Tomcat: sweep webapps and work directories for unauthorized JSP/WAR artifacts, review access logs for anomalous request patterns (path manipulation, unusual upload sizes, requests from single-source IPs hammering one endpoint), and validate that no new context descriptors appeared.

Structural (this quarter):

7. Get RMM and AI tooling out of the flat network. N-central and Langflow consoles should live on management segments reachable only from jump hosts with MFA. Tomcat instances should sit behind a reverse proxy/WAF, never directly internet-exposed.
8. Constrain service accounts. Tomcat should not run as root/SYSTEM; Langflow should not hold cloud credentials broader than its function requires. Post-exploitation blast radius is determined by the privileges you granted the service before anyone attacked it.
9. Operationalize the KEV feed. If your vulnerability management program still treats CVSS as the primary prioritization signal, this is your corrective: KEV-listed vulnerabilities with sub-week federal deadlines must page a human, not queue in a monthly patch cycle. Wire the KEV catalog into your scanner and ticketing pipeline so listing triggers an SLA measured in days, not weeks.

The pattern here — AI orchestration tooling, RMM, and web middleware exploited simultaneously — reflects how adversaries are targeting the operational backbone of modern environments rather than perimeter endpoints. Your detection posture has to match: parent/child process analytics on servers, file-integrity monitoring on application directories, and egress monitoring from service processes are the controls that catch what patch latency misses.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub