CISA Adds Actively Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical security vulnerabilities present in Langflow and Trend Micro Apex One to its Known Exploited Vulnerabilities (KEV) catalog. This update reflects confirmed evidence of active exploitation of these flaws in the wild, emphasizing the importance of prompt mitigation for affected users.

What happened

On Thursday, CISA announced the inclusion of two vulnerabilities affecting Langflow and Trend Micro Apex One into its KEV catalog. The first identified flaw, CVE-2025-34291, is characterized as an origin validation error within Langflow carrying a high CVSS score of 9.4. The agency’s decision to add these vulnerabilities to the KEV list is based on credible reports of ongoing exploitation efforts targeting these security weaknesses.

Why it matters

The addition of these vulnerabilities to CISA’s Known Exploited Vulnerabilities catalog signals a heightened risk environment for organizations using Langflow and Trend Micro Apex One. Publicly acknowledged active exploitation indicates attackers are successfully leveraging these flaws, potentially compromising systems or data if left unaddressed. This update serves as a prompt for security teams to prioritize remediation to reduce exposure and prevent further incidents.

What security teams should do

Security teams responsible for Langflow and Trend Micro Apex One deployments should urgently review exposure to CVE-2025-34291 and the associated Trend Micro Apex One vulnerability. Immediate application of vendor patches or mitigations, as provided in official advisories, is recommended to close these attack vectors. Monitoring for unusual activity related to these vulnerabilities and updating intrusion detection mechanisms to include relevant signatures may further help contain ongoing exploitation attempts.

Key technical details

The vulnerability CVE-2025-34291 in Langflow involves an origin validation error, which can allow attackers to bypass certain security controls leading to unauthorized actions. With a CVSS base score of 9.4, it is classified as a critical security flaw. Although details on the Trend Micro Apex One vulnerability were not fully specified in the announcement, its designation as a KEV-listed issue confirms both are being actively exploited in the wild.

Affected organizations/products

Organizations utilizing Langflow and Trend Micro Apex One should consider themselves at heightened risk due to the active exploitation of these vulnerabilities. The scope includes systems running vulnerable versions of these products until appropriate patches or mitigations are applied.

Source attribution

https://thehackernews.com/2026/05/cisa-adds-exploited-langflow-and-trend.html