I’m a few days late on this one, but the content holds up: last week’s Reachability Watch, written by our Chief Strategy and Marketing Officer Mark Jaffe, covering September 11–17, is here:
https://netfoundry.io/ai/reachability-watch-cve-kev-tracker-2026-09-18/
(On the bright side, I had time to draw a “back of the envelope” comic that covers the big CVE!)
The CVE numbers
Here are the numbers:
- 1,248 new network-exploitable CVEs
- 117 of these CVEs are rated at 8.6 or higher
- 12 of these CVEs are a perfect 10.0:
- 9 of those twelve in vm2 alone
Worth reading
1. The Langflow flaw
CVE-2026-85025 (9.8) is unauthenticated RCE in IBM Langflow OSS 1.0.0–1.11.5. It’s reachable through publicly shared MCP project endpoints, with read and write access to chat sessions on top. Whatever context, credentials, or proprietary data flowed through those sessions comes along with it.
The mechanism is the interesting part. Langflow lets you share a flow via an MCP project endpoint so other tools and agents can call it programmatically. The code that’s supposed to enforce “this one flow is public, everything else isn’t” doesn’t hold that boundary. So “publicly shared” quietly generalizes from one flow to the host. This happens without a privilege escalation chain, user interaction, or even any waiting for someone to click anything.
All in all: 8 CVEs against Langflow in a single seven-day window, including the one above: code injection, OS command injection, path traversal, an incomplete scanner denylist, and this one.
2. The difference between CVE vs. KEV
- CVE: Common Vulnerabilities and Exposures. These are publicly-disclosed security flaws, and may or may not have been used in an attack. These are weaknesses that have been announced.
- KEV: Known Exploited Vulnerability. This is a CVE that CISA (Cybersecurity and Infrastructure Security Agency) has confirmed is being actively exploited against real targets. A KEV is a CVE that got a job.
Mark writes that he’d bet money that the Langflow flaw above becomes a KEV. Another Langflow CVE has already done that: CVE-2025-3248, a missing-authentication RCE, which went onto CISA’s KEV catalog on May 5, 2025, with a three-week federal remediation deadline and confirmed ransomware use. Sysdig later documented that same flaw on a server nobody had patched in over a year as the entry point for what they assessed as the first fully autonomous agentic ransomware operation.
The traits that move a CVE onto KEV are the traits this one has: no auth, trivially scannable, and sitting on infrastructure that isn’t in anyone’s asset inventory. Langflow has supplied both ends of that pipeline before.
3. Why AI agent platforms keep showing up in Reachability Watch
Because these tools are three things all at once:
- New
- Fast-moving
- Production-critical
…and they’re shipped by teams optimizing for getting an AI capability out the door. As a result, exposure and hardening get less scrutiny than they’d get on a mature enterprise system.
The part that makes them worth an attacker’s time specifically: compromising one doesn’t get you a single host, it gets you the whole key ring. The same property that makes the platform useful is what makes the blast radius large, which is why “it’s just an internal tool on a dev box” ages so badly.