What happened

Two vulnerabilities were added to CISA's Known Exploited Vulnerabilities catalog. Both need attention.

The first is a code injection flaw in Langflow. Teams use Langflow to build AI agents and automated workflows. The second is more serious. Malicious code was found inside Trivy, an open source security scanner from Aqua Security.

Federal agencies must fix both by the first week of April. Treat that date as a signal to act.

The Trivy issue should change how you think about risk. A security tool was compromised. Attackers used a trusted tool to gain access.

Why this matters for your business

This matters even if you do not use Langflow or Trivy.

Your business depends on software from many sources. Open source packages, third party tools, and AI frameworks show up across environments. Many enter through development teams without formal review.

Attackers target this path because it works. If a tool runs with network access or elevated permissions, it has reach. Your existing controls do not cover this risk.

Most organizations lack visibility. You need a full list of software running in your environment. Many teams do not have one.

CIS Control 2 addresses this gap. You need to know what software is approved, where it runs, and how updates occur. Without this, you cannot respond when a trusted tool becomes a threat.

What to do now

Start with visibility.

Build a list of all open source and third party tools in your environment. Include development tools, security tools, and AI platforms. Focus on anything with elevated access or broad network reach.

Review how your team handles updates. Verify packages with checksums or vendor signatures. Do not pull code from public repositories without validation.

Ask your IT team or MSP if Langflow or Trivy exist in your environment. If they do, follow CISA guidance and remediate before the deadline.

One step you can take today

Pull a list of every third party and open source tool your team uses. Include anything installed by developers or IT.

If you do not have this list, start there.

A CIS IG1 gap analysis from Tech Cartographer will surface these gaps and give you a clear plan to fix them. Reach out and let's get started.