AI Hacking Campaign Exploits Tomcat, Langflow, N-central Flaws

A Chinese-speaking threat actor, identified as "knaithe" and "KnYuan," is using the DeepSeek AI model as the reasoning engine for the open-source Hermes Agent framework. This AI-powered autonomous hacking campaign, observed by Palo Alto Networks Unit 42, claims to have attempted to exploit over 460 targets across more than 100 countries. It specifically targets critical vulnerabilities like CVE-2026-34486 in Apache Tomcat and CVE-2026-9198 in IBM Langflow, both added by CISA to its Known Exploited Vulnerabilities (KEV) Catalog on August 4, 2026, with a federal patch deadline of August 7, 2026. This campaign significantly accelerates reconnaissance and exploitation, reducing hundreds of hours of manual effort to minutes, according to Palo Alto Networks Unit 42.

What Happened

CISA recently added four critical vulnerabilities to its KEV Catalog due to confirmed active exploitation. CVE-2026-34486 (Apache Tomcat Missing Encryption of Sensitive Data), CVE-2026-9198 (IBM Langflow Code Injection), and CVE-2026-18556 (N-able N-central Authentication Bypass) were all listed on August 4, 2026, with a mandatory patch date of August 7, 2026. CVE-2026-63077 (JetBrains TeamCity Deserialization) followed on August 5, 2026, with an August 8, 2026, deadline.

A Chinese-speaking threat actor, identified as "knaithe" and "KnYuan," is behind an AI-powered autonomous hacking campaign. This actor uses the DeepSeek AI model as the reasoning engine for the open-source Hermes Agent framework, automating offensive operations. The AI agent performs autonomous vulnerability enumeration using search engines like FOFA, downloads public exploit code from GitHub, and attempts to exploit targets without human intervention. This setup allows the agent to dynamically research and pivot to other high-value vulnerabilities if initial exploit attempts fail, according to researchers from Palo Alto Networks Unit 42 who observed the actor's operations after they inadvertently exposed their infrastructure due to a misconfigured file server. The actor has experimented with various LLMs, including Chinese models (DeepSeek, Qwen, GLM, Kimi, MiniMax) and Western tools (Claude Code, Codex), showing a clear preference for DeepSeek.

The N-able N-central vulnerabilities (CVE-2026-18556 and its bypass CVE-2026-18577) were exploited as zero-days to gain administrative access, enabling lateral movement to managed endpoints. N-able confirmed exploitation affected a limited number of N-able customers, but did not specify the exact number. Indicators of Compromise (IoCs) for CVE-2026-18577 include "svchost.exe" in user documents, a registered service named "Cloudflared," and inbound connections from specific IP addresses such as 173.249.252[.]200, 87.249.138[.]34, 37.19.210[.]32, and 68.235.46[.]214, often associated with VPN exit nodes.

Why It Matters

This represents a new operational tempo for threat actors. The AI-driven campaign by "knaithe" reduces the time for target identification and analysis from what historically took hundreds of hours to a few minutes, as reported by Palo Alto Networks Unit 42. This dramatically increases the scale and speed of potential exploitation. We are facing an adversary whose reconnaissance capabilities are now almost instantaneous.

The campaign has attempted to exploit over 460 targets across 100+ countries, blending autonomous and manual techniques against government and commercial infrastructure globally, according to the threat actor's claims observed by Palo Alto Networks Unit 42. Exploiting CVE-2026-34486 in Apache Tomcat cluster components allows unauthenticated remote code execution (RCE). Similarly, CVE-2026-9198 in IBM Langflow, with its CVSS 9.8 critical score, facilitates unauthenticated RCE on default deployments by chaining two API endpoints. Yes, CVSS 9.8. But exploitation requires network access — internal-only systems buy some time.

For N-able N-central users, the zero-day exploitation of CVE-2026-18556 and CVE-2026-18577 granted threat actors administrative access to critical management servers, allowing them to pivot to managed endpoints. This level of access is a direct pathway to widespread compromise, even if N-able confirmed only a limited number of customers were initially affected.

Affected Scope & Remediation

Organizations running affected versions of Apache Tomcat, IBM Langflow, N-able N-central, and JetBrains TeamCity must patch these vulnerabilities immediately, especially given their inclusion in CISA's KEV Catalog. The federal patch due date for CVE-2026-34486, CVE-2026-9198, and CVE-2026-18556 is August 7, 2026, with CVE-2026-63077 due by August 8, 2026. If your systems are public-facing, you're a prime target for these autonomous AI agents.

To patch Apache Tomcat CVE-2026-34486, upgrade to a fixed version. For IBM Langflow, N-able N-central, and JetBrains TeamCity, apply the latest security updates as advised by the vendors.

Vendor advisories and NVD entries provide full details:

• Apache Tomcat CVE-2026-34486 NVD Entry
• IBM Langflow CVE-2026-9198 NVD Entry
• N-able N-central CVE-2026-18556 NVD Entry
• JetBrains TeamCity CVE-2026-63077 NVD Entry
• CISA KEV Catalog Entry

For Apache Tomcat CVE-2026-34486, if immediate patching isn't feasible, ensure that Tomcat cluster components are isolated and not directly exposed to untrusted networks. Implement strict network segmentation and firewall rules to restrict access to these components to only necessary internal systems. For N-able N-central, consider placing the server behind a security solution like Cloudflare Zero Trust or a dedicated VPN to limit administrative interface exposure.

The fix for CVE-2026-34486 was released in April 2026, roughly 4 months before it hit the KEV catalog. For CVE-2026-9198, the fix came in July 2026, about 1 month before CISA added it to KEV. The N-able vulnerabilities were exploited as zero-days before patches were available, highlighting a critical window of exposure.

Technical Breakdown

CVE-2026-34486 in Apache Tomcat is categorized as a "Missing Encryption of Sensitive Data" vulnerability, but its impact goes beyond just data exposure. It describes a bypass of the EncryptInterceptor in Tomcat cluster components. This interceptor is designed to secure communication between cluster members, such as session replication data. The flaw isn't about breaking the encryption itself, but rather a logical bypass where sensitive data can flow between cluster nodes without being intercepted and encrypted as intended, or where an attacker can interact with these components directly without proper authentication. This ultimately leads to unauthenticated RCE on the vulnerable cluster members.

Think of it like this: your data is supposed to travel in an armored vehicle between two secure facilities. The EncryptInterceptor is the guard who checks that the data is loaded into the vehicle and sealed. The bypass isn't that someone cracked the armor; it's that they found a back alley where they could load their own package directly into the vehicle, or even drive the vehicle themselves, without the guard ever seeing it. This grants them control over the destination system.

CVE-2026-9198 in IBM Langflow allows for unauthenticated RCE by chaining two API endpoints. This typically points to a sequence of requests where the first request sets up a vulnerable state or session, and the second exploits it, possibly due to improper validation or authorization checks between the calls.

The N-able N-central flaws (CVE-2026-18556 and CVE-2026-18577) are authentication bypass vulnerabilities. Attackers can gain administrative access to N-central servers without valid credentials. The existence of CVE-2026-18577 as a bypass for an earlier fix (CVE-2026-18556) highlights a common problem: an incomplete patch that failed to address the underlying architectural weakness, leaving the door open for a slightly modified exploit.

From a MITRE ATT&CK perspective, the "knaithe" campaign extensively uses T1190 Exploit Public-Facing Application for initial access against Tomcat, Langflow, and N-central. The AI agent's ability to download exploit code from GitHub fits T1105 Ingress Tool Transfer. For the N-central exploitation, gaining administrative access without valid credentials is akin to T1078 Valid Accounts, as it grants equivalent permissions, and leveraging this to pivot to managed endpoints aligns with T1068 Exploitation for Privilege Escalation.

For NIST SP 800-53, immediate SI-2 Flaw Remediation (patching) is paramount. Beyond patching, implementing SC-7 Boundary Protection is critical to limit exposure of these vulnerable services to untrusted networks. The issues with N-central's incomplete fix also highlight the need for thorough SI-2 Flaw Remediation processes that encompass validation of patches.

Historical Context

This AI-driven campaign recalls the rapid, widespread exploitation that followed the Log4Shell (CVE-2021-44228) vulnerability in Apache Log4j, which surfaced in December 2021. Both incidents targeted ubiquitous software components (Apache Tomcat is nearly as pervasive as Log4j) that are critical to modern infrastructure, exposing a vast attack surface. In both cases, the moment a critical RCE vulnerability became public, threat actors globally initiated massive scanning and exploitation efforts. The speed with which Log4Shell was adopted by ransomware gangs and state-backed actors demonstrated the immediate impact of such flaws.

What's similar is the reliance on widely deployed software as a pivot for RCE. Both saw automated exploitation attempts on a global scale, targeting any exposed instance. The imperative to patch immediately was equally urgent.

The key difference here, however, is the sophistication of the automation. While Log4Shell exploitation primarily involved human operators wielding advanced scanning tools and exploit scripts, "knaithe"'s campaign represents an evolution. The use of DeepSeek within the Hermes Agent framework for autonomous vulnerability enumeration and dynamic exploit pivoting is a significant leap. It's not just automating execution; it's automating reasoning and adaptation. This reduces the attacker's required technical depth for each target, democratizing sophisticated exploitation and vastly increasing the speed and efficiency of initial access, effectively moving beyond mere "script kiddies" to something closer to "AI agents" as operators.

Data at a Glance

The CVEDaily Take

This campaign shows that traditional manual vulnerability management struggles to keep pace with AI-accelerated exploitation. The imperative to patch these KEVs, especially CVE-2026-34486 in Tomcat, is non-negotiable, but the bigger picture is the rapid obsolescence of slow patch cycles. We see a future where AI-driven attacks close the window between vulnerability disclosure and widespread exploitation to hours, not days or weeks. This necessitates automated vulnerability scanning and patching solutions that can react in minutes.

Has your organization invested in automated vulnerability scanning and patching solutions that can react in minutes, not days, to vulnerabilities like these?

FAQ

Q: What is the primary impact of CVE-2026-34486 on Apache Tomcat?
A: CVE-2026-34486 is a Missing Encryption of Sensitive Data vulnerability that allows for a bypass of the EncryptInterceptor in Apache Tomcat cluster components. This leads to unauthenticated remote code execution (RCE) on affected cluster members, giving attackers full control.

Q: How is the "knaithe" threat actor using AI in their campaign?
A: The "knaithe" threat actor is using the DeepSeek AI model as the reasoning engine for the Hermes Agent framework. This AI agent autonomously performs reconnaissance, vulnerability enumeration using tools like FOFA, downloads public exploit code from GitHub, and dynamically pivots to new vulnerabilities if initial attempts fail, significantly accelerating the entire attack lifecycle.

Q: What should organizations do immediately if they use N-able N-central?
A: Organizations using N-able N-central must immediately apply the patch to version 2026.3 HF1 to address CVE-2026-18556 and CVE-2026-18577. Additionally, restrict network access to the N-central server's administrative interfaces to trusted internal networks only, or utilize solutions like Cloudflare Zero Trust for secure remote access.