# CISA adds Langflow and Trend Micro flaws to exploited catalog

Published: 2026-05-21 · Severity: high · Sectors: government-national
Canonical: https://vorant.io/reports/eecd3a04-f510-53dd-96a1-159588a88808/cisa-adds-langflow-and-trend-micro-flaws-to-exploited-catalog

> CISA confirms active exploitation of origin validation flaw in Langflow and directory traversal in Trend Micro Apex One.

CISA has added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active in-the-wild exploitation. CVE-2025-34291 affects Langflow and involves an origin validation error that could allow attackers to bypass security controls. CVE-2026-34926 is a directory traversal vulnerability in Trend Micro Apex One (On-Premise) that enables unauthorized file access.

Both vulnerabilities are being actively exploited and pose significant risk to federal networks. While Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate by specified due dates, CISA urges all organizations to prioritize patching these flaws as part of their vulnerability management program. The addition to the KEV Catalog reflects these threats' real-world exploitation and severity.

## Mentioned in this report

- Vulnerabilities: CVE-2025-34291 (KEV), CVE-2026-34926 (KEV)

## Detection guidance (public sample)

### Directory Traversal Sequences in Web Request with Successful Response

ATT&CK: T1190

Detects web requests containing plain or encoded directory traversal sequences that return HTTP 200, matching exploitation of path traversal flaws in public-facing apps such as Trend Micro Apex One (CVE-2026-34926). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Directory Traversal Sequences in Web Request with Successful Response
id: 7a27eb87-ed54-5cad-99f6-36493dec9b58
status: experimental
description: Detects HTTP requests to a web server that contain plain or URL-encoded
  directory traversal sequences and receive an HTTP 200 response. This is consistent
  with exploitation of path traversal vulnerabilities in public-facing management
  consoles such as Trend Micro Apex One. Generalises on the traversal pattern, not
  on a specific endpoint.
tags:
- attack.initial-access
- attack.t1190
- attack.discovery
- attack.t1083
logsource:
  category: webserver
detection:
  selection_traversal:
  - cs-uri-stem|contains:
    - ../
    - ..%2f
    - '%2e%2e%2f'
    - '%2e%2e/'
    - ..%5c
    - '%2e%2e%5c'
    - '%252e%252e'
  - cs-uri-query|contains:
    - ../
    - ..%2f
    - '%2e%2e%2f'
    - '%2e%2e/'
    - ..%5c
    - '%2e%2e%5c'
    - '%252e%252e'
  selection_status:
    sc-status: 200
  condition: selection_traversal and selection_status
falsepositives:
- Vulnerability scanners run by the internal security team against web applications
- Applications that legitimately pass relative paths in query parameters
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/05/21/cisa-adds-two-known-exploited-vulnerabilities-catalog
```

### Langflow Process Spawning Shell

ATT&CK: T1190

Detects a Python process running Langflow spawning a shell interpreter, indicative of remote code execution after exploitation of the Langflow server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Langflow Process Spawning Shell
id: 66eb5ea4-68af-5c05-834b-b248c0235c59
status: experimental
description: Detects a Python process whose command line references Langflow spawning
  a shell (sh, bash, dash). A Langflow server abused through a public-facing vulnerability
  such as CVE-2025-34291 can be leveraged for command execution, which shows up as
  this parent/child relationship.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: python
    ParentCommandLine|contains: langflow
    Image|endswith:
    - /sh
    - /bash
    - /dash
  condition: selection
falsepositives:
- Langflow custom components or deployment scripts that intentionally invoke shell
  commands
- Container entrypoint scripts that launch Langflow through a shell wrapper
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/05/21/cisa-adds-two-known-exploited-vulnerabilities-catalog
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/05/21/cisa-adds-two-known-exploited-vulnerabilities-catalog

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/eecd3a04-f510-53dd-96a1-159588a88808/cisa-adds-langflow-and-trend-micro-flaws-to-exploited-catalog.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup