OTX Threat: Attackers Target AI Development Platform Langflow

In September 2026, F5 Labs detected 405 exploitation attempts targeting CVE-2026-0768, an unauthenticated remote code execution vulnerability in Langflow AI application-building platform, originating from 55 distinct IP addresses. This marks the first observation of an AI/ML development platform RCE in opportunistic internet-wide scanning. Captured payloads included capability probing with unique CVEs: CVE-2018-20062, CVE-2016-4800, CVE-2017-9841, CVE-2020-15505, CVE-2021-26855