CISA KEV Flash: 6 CVEs Added — Progress LoadMaster, JetBrains TeamCity & N-able N-central Under Active Attack

---
title: Suspicious Child Process from LoadMaster or ADC Service Context
description: Detects command execution child processes spawned by Progress LoadMaster web/management services, consistent with CVE-2026-8037 command injection exploitation.
author: Security Arsenal Threat Intel
status: experimental
logsource:
    category: process_creation
    product: windows
    # For Linux ADC appliances, map to equivalent EDR/Sysmon for Linux process events
    product: linux
detection:
    selection_parent:
        ParentImage|contains:
            - 'nginx'
            - 'httpd'
            - 'apache2'
            - 'loadmaster'
            - 'lm_'
            - 'haproxy'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '/bin/sh'
            - '/bin/bash'
            - '/usr/bin/curl'
            - '/usr/bin/wget'
            - '/usr/bin/python'
            - '/usr/bin/perl'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate ADC health-check scripts; baseline and whitelist known management scripts
level: high
tags:
    - attack.execution
    - attack.t1059
    - attack.t1190
    - cve.2026.8037
date: 2026/08/07
---
title: TeamCity Server Spawning Suspicious Child Processes - CVE-2026-63077
description: Detects TeamCity server processes spawning shells or script interpreters, indicative of deserialization RCE exploitation (CVE-2026-63077) and post-exploitation activity in the build pipeline.
author: Security Arsenal Threat Intel
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains:
            - 'TeamCity'
            - 'teamcity-server'
            - 'java.exe'
        CommandLine|contains:
            - 'teamcity'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\mshta.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Build steps legitimately invoking cmd/powershell — correlate with build job IDs; unexpected execution outside build windows is high-fidelity
level: critical
tags:
    - attack.execution
    - attack.t1059
    - attack.t1190
    - attack.supply_chain_compromise
    - attack.t1195
    - cve.2026.63077
date: 2026/08/07
---
title: N-central or Langflow Authentication Bypass and Anomalous Session Indicators - CVE-2026-18556 / CVE-2026-18577 / CVE-2026-9198
description: Detects web access patterns consistent with authentication bypass via alternate paths on N-able N-central consoles and unauthenticated code execution requests against Langflow endpoints.
author: Security Arsenal Threat Intel
status: experimental
logsource:
    category: webserver
    # Ingest N-central, Langflow, and reverse proxy access logs into a webserver log source
detection:
    selection_ncentral:
        c-uri-path|contains:
            - '/dms/'
            - '/api/'
        c-uri-path|contains:
            - '..'
            - '%2e'
            - ';'
            - '%3b'
        sc-status: 200
    selection_langflow_exec:
        c-uri-path|contains:
            - '/api/v1/validate/code'
            - '/api/v1/build'
            - '/api/v1/flows'
        cs-method:
            - 'POST'
            - 'PUT'
    condition: selection_ncentral or selection_langflow_exec
falsepositives:
    - Legitimate API integrations — filter by known-authenticated source IPs and API tokens; unauthenticated sources hitting these paths post-patch are high-fidelity
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - attack.t1078
    - cve.2026.18556
    - cve.2026.18577
    - cve.2026.9198
date: 2026/08/07

// KEV Wave 2026-08-03..07: TeamCity, N-central, LoadMaster, Langflow exploitation hunt
let Lookback = 7d;
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","certutil.exe","bitsadmin.exe","curl.exe","wget.exe","sh","bash","python","perl"]);
let ServiceContexts = dynamic(["teamcity","ncentral","n-able","loadmaster","haproxy","nginx","httpd","tomcat","langflow","java.exe"]);
union
(
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName has_any (ServiceContexts) or InitiatingProcessCommandLine has_any (ServiceContexts)
    | where FileName in~ (SuspiciousChildren)
    | project Hunt="SuspiciousChildProcess", TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
),
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName has_any (ServiceContexts)
    | where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
    | summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RemoteIPs=make_set(RemoteIP, 20) by DeviceName, InitiatingProcessFileName
    | project Hunt="MgmtServiceOutbound", FirstSeen, LastSeen, DeviceName, InitiatingProcessFileName, Connections, RemoteIPs
),
(
    SigninLogs
    | where TimeGenerated > ago(Lookback)
    | where AppDisplayName has_any ("N-central","TeamCity","Langflow")
    | summarize Signins=count(), IPs=make_set(IPAddress, 10), Users=make_set(UserPrincipalName, 10) by AppDisplayName, ResultType
    | project Hunt="ConsoleAuthAnomaly", AppDisplayName, ResultType, Signins, IPs, Users
)
| order by TimeGenerated desc

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    KEV 2026-08-03..07 Inventory & Patch Verification
    Covers: CVE-2026-8037 (LoadMaster), CVE-2026-63077 (TeamCity),
            CVE-2026-18556 / CVE-2026-18577 (N-central),
            CVE-2026-34486 (Tomcat), CVE-2026-9198 (Langflow)
.NOTES
    Run on each candidate server. Review output CSV; remediate anything
    flagged [EXPOSED] or [UNPATCHED] per vendor advisory immediately.
#>

$ErrorActionPreference = 'SilentlyContinue'
$Report = @()

function Add-Finding {
    param($Product, $CVE, $Version, $Status, $Detail)
    $script:Report += [PSCustomObject]@{
        Host    = $env:COMPUTERNAME
        Product = $Product
        CVE     = $CVE
        Version = $Version
        Status  = $Status
        Detail  = $Detail
    }
}

# ---------- 1. JetBrains TeamCity ----------
$tcPaths = @("C:\TeamCity","C:\Program Files\TeamCity","D:\TeamCity")
foreach ($p in $tcPaths) {
    if (Test-Path $p) {
        $verFile = Get-Content "$p\conf\teamcity-startup.properties" -Raw
        $build   = (Select-String -Path "$p\webapps\ROOT\WEB-INF\build.number" -Pattern "build.number=(.+)" -AllMatches).Matches.Groups[1].Value
        Add-Finding "JetBrains TeamCity" "CVE-2026-63077" $build "[REVIEW]" "TeamCity install at $p - verify build against JetBrains fixed-build advisory and apply upgrade immediately"
    }
}

# ---------- 2. N-able N-central ----------
$ncServices = Get-Service | Where-Object { $_.DisplayName -match "N-central|Nable|N-able" }
if ($ncServices) {
    $ncServices | ForEach-Object {
        Add-Finding "N-able N-central" "CVE-2026-18556 / CVE-2026-18577" $_.Status "[REVIEW]" "Service $($_.Name) present - apply N-able security update, rotate ALL credentials and API tokens, audit for rogue admin accounts"
    }
}

# ---------- 3. Apache Tomcat ----------
$tomcatServices = Get-Service | Where-Object { $_.Name -match "Tomcat" -or $_.DisplayName -match "Tomcat" }
foreach ($svc in $tomcatServices) {
    $exe = (Get-CimInstance Win32_Service -Filter "Name='$($svc.Name)'").PathName
    Add-Finding "Apache Tomcat" "CVE-2026-34486" $svc.Status "[REVIEW]" "Service $($svc.Name): $exe - if clustered with EncryptInterceptor, upgrade to fixed Tomcat release"
}
# Embedded Tomcat hunt (vendor appliances often hide it)
Get-ChildItem -Path "C:\Program Files","C:\Program Files (x86)" -Recurse -Filter "catalina.jar" -Depth 4 -ErrorAction SilentlyContinue | ForEach-Object {
    Add-Finding "Embedded Tomcat" "CVE-2026-34486" $_.VersionInfo.ProductVersion "[EXPOSED]" "Embedded Tomcat at $($_.FullName) - contact appliance vendor for patched firmware"
}

# ---------- 4. Langflow ----------
$langflowProcs = Get-Process | Where-Object { $_.ProcessName -match "langflow" }
$langflowPip   = (pip show langflow 2>$null | Select-String "Version: (.+)").Matches.Groups[1].Value
if ($langflowProcs -or $langflowPip) {
    Add-Finding "IBM Langflow" "CVE-2026-9198" $langflowPip "[EXPOSED]" "Langflow detected - patch immediately, enforce authentication, remove internet exposure on 7860/7863"
}

# ---------- 5. Internet-exposed listener check ----------
$exposedPorts = 8111, 9090, 7860, 7863, 443, 8443   # TeamCity, N-central, Langflow, mgmt consoles
$listeners = Get-NetTCPConnection -State Listen | Where-Object { $exposedPorts -contains $_.LocalPort -and $_.LocalAddress -notmatch "127\.0\.0\.1|::1" }
foreach ($l in $listeners) {
    $proc = (Get-Process -Id $l.OwningProcess).ProcessName
    Add-Finding "Network Listener" "N/A" "$($l.LocalAddress):$($l.LocalPort)" "[EXPOSED]" "Non-loopback listener owned by $proc - confirm firewall segmentation; management consoles must not be internet-reachable"
}

# ---------- Output & validation ----------
$out = "$env:TEMP\KEV_2026-08_Wave_Inventory_$env:COMPUTERNAME.csv"
$Report | Export-Csv $out -NoTypeInformation
$Report | Format-Table -AutoSize
Write-Host "`nReport written to $out"
Write-Host "NEXT STEPS: 1) Apply vendor patches per advisory. 2) Re-run this script and confirm [REVIEW]/[EXPOSED] findings are resolved. 3) For N-central: rotate credentials + audit accounts. 4) For TeamCity: audit build configs for unauthorized modifications and rotate VCS tokens."