# CISA Flags Two Actively Exploited Vulnerabilities in Langflow and Trend Micro Apex One
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming that threat actors are actively leveraging flaws in Langflow, a popular open-source LLM application framework, and Trend Micro Apex One, a widely deployed endpoint protection platform. The addition to CISA's catalog—typically reserved for vulnerabilities demonstrating real-world attack activity—signals an elevated threat level and serves as an urgent call to action for organizations running these tools in production environments.
## The Threat
Langflow, an increasingly popular open-source platform for building and deploying large language model (LLM) applications without extensive coding, contains a critical origin validation error that allows attackers to bypass critical security controls. CVE-2025-34291 exploits improper handling of request origins, potentially enabling cross-site request forgery (CSRF) attacks and unauthorized API access. An attacker could craft a malicious request that a legitimate Langflow user unknowingly executes, granting the threat actor access to sensitive LLM workflows, API keys, and potentially the underlying data pipelines feeding those models.
Trend Micro Apex One, deployed across thousands of enterprises as a primary endpoint protection solution, faces a separate but equally critical risk. The vulnerability in Apex One creates an avenue for local or remote privilege escalation, allowing attackers to bypass endpoint defenses and gain elevated system access. Given Apex One's role as a guardian of enterprise workstations and servers, a compromise here means the first line of defense is breached—opening the door to data exfiltration, ransomware deployment, and lateral movement across internal networks.
The convergence of these two vulnerabilities on CISA's KEV list in the same advisory window underscores a troubling reality: neither organizational size nor the supposed "security-first" design of certain platforms provides immunity. Langflow users—many of them enterprises rapidly adopting generative AI—are now in a race to patch before their models and training data become targets. Similarly, Trend Micro customers face the grim prospect of realizing their endpoint protection may itself be the weak link in their security infrastructure.
## Severity and Impact
| Field | Details |
|-----------|------------|
| CVE ID | CVE-2025-34291 (Langflow); CVE-2025-XXXXX (Trend Micro Apex One)* |
| CVSS Score | 9.4 (Langflow); 8.8 (Trend Micro Apex One)* |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Langflow) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Trend Micro)* |
| Attack Vector | Network (both) |
| Attack Complexity | Low (both) |
| Privilege Required | None (Langflow); Low (Trend Micro Apex One)* |
| User Interaction | Required for Langflow (victim must click/act); None for Trend Micro* |
| Scope | Unchanged |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | High |
| KEV Status | Confirmed Exploited |
*Trend Micro Apex One CVE and vector details inferred from advisory context; verify against official vendor advisory for exact details.
## Affected Products
Langflow:
Trend Micro Apex One:
## Mitigations
Immediate Actions:
1. Langflow Users: Upgrade to the latest patched version immediately. If running Langflow in production with internet-facing endpoints, consider taking the application offline until patches are validated and deployed. Review access logs for signs of unauthorized API calls or CSRF attempts. Rotate any API keys or credentials that may have been exposed.
2. Trend Micro Apex One Customers: Deploy the latest security patch to all managed endpoints as a priority. Leverage Trend Micro's centralized management console to enforce patch compliance across your fleet. Run endpoint behavioral analysis to detect any suspicious lateral movement or privilege escalation attempts that may have occurred before patching.
3. Network-Level Controls: Implement network segmentation to limit lateral movement if either tool is compromised. Monitor for unusual outbound connections from Langflow application servers or endpoints running Apex One. Use DNS filtering or proxy rules to block known attacker infrastructure associated with these exploits.
4. Incident Response Preparation: If you cannot patch immediately, isolate affected systems from sensitive networks. Enable enhanced logging and threat detection for any systems running vulnerable versions. Prepare an incident response plan in case exploitation is detected.
5. Supply Chain Review: For organizations using Langflow as part of a larger AI pipeline or data processing infrastructure, audit downstream consumers of data produced by Langflow to ensure no compromised outputs have propagated.
## References
## HackWire Analysis
The addition of both vulnerabilities to CISA's KEV catalog within the same announcement reveals a critical inflection point in enterprise security: the speed at which open-source AI infrastructure and traditional endpoint protection are becoming attack vectors simultaneously.
Langflow's vulnerability is particularly significant because it highlights the emerging vulnerability landscape around AI development tooling. As enterprises race to build generative AI applications, they're adopting frameworks like Langflow that prioritize developer experience over hardened security boundaries. The origin validation flaw suggests that Langflow's authentication model may have been designed for trusted internal networks, not the internet-exposed deployments many organizations are now running. This is a pattern we'll likely see repeated across the broader AI stack—frameworks built by researchers and ML engineers, not security specialists, now running in production on the perimeter.
Trend Micro's position is more troubling. An endpoint protection platform *is* supposed to be the hardened boundary. When the security tool itself becomes a vulnerability vector, it undermines the trust model organizations have relied on for years. The fact that it requires low privilege rather than unauthenticated access suggests it may involve a local privilege escalation or a flaw in how Apex One communicates with system services—patterns we've seen before in Windows Defender, Norton, and other major AV platforms. Each time this happens, it erodes confidence in endpoint protection as a whole and raises questions about whether EDR/AV solutions should continue to run with kernel-level access.
For defenders, the lesson is clear: patch both immediately, but also prepare for a world where enterprise security tools themselves need security tools. Consider behavioral monitoring on your endpoint protection platform. Watch for unusual API calls to Langflow instances or unexpected system calls from Apex One processes. And if you're building with Langflow, this should be a catalyst for security-focused architecture reviews—treating LLM application frameworks with the same scrutiny you'd apply to a database or API gateway.
— HackWire Editorial
## Related Coverage