CISA Adds Four Actively Exploited ColdFusion, Langflow, and Joomla Flaws to the KEV Catalog

On July 8, a rapid expansion to the known-exploited vulnerabilities catalog brought four actively abused flaws into mandatory compliance windows. The update targets a legacy enterprise framework, dual-content-management-system extensions, and an AI workflow platform, illustrating how threat actors continue to hunt for high-utility entry points across both classic infrastructure and emerging tooling. Federal systems faced an unusually compressed remediation timeline as agencies scrambled to neutralize these exposures before the government mandate expired.

The most critical exposure identified in the update stems from Adobe ColdFusion, now cataloged for CVE-2026-48282, a CVSS 10 path-traversal flaw that permits unauthenticated file reads across server directories. Because the vulnerability effectively bypasses authentication boundaries to expose local filesystem contents, it routinely enables full remote code execution and credential dumping when triggered. Threat actors began circulating functional exploit code mere hours after the vulnerabilities were formally logged, leaving patch teams with barely enough time to apply host-level mitigations and rotate any exposed secrets before the federal deadline.

Joomla-based deployments face parallel exposure across two distinct page-builder extensions that carry identical CVSS 10 ratings. CVE-2026-56290 impacts the Joomlack Page Builder module, while CVE-2026-48908 compromises the widely distributed JoomShaper SP Page Builder, both allowing administrators or untrusted contributors to execute arbitrary commands inside the core CMS container. These extensions have historically served as reliable bridge points for lateral movement, meaning that successfully weaponizing either flaw bypasses standard web-application firewalls entirely and grants attackers unhindered access to database backends and server-side templates.

Beyond traditional web stacks, the catalog addition marks one of the few federal warnings aimed directly at generative-AI development frameworks in their current operational form. CVE-2026-55255 introduces a cross-tenant insecure direct object reference inside Langflow that allows attackers to escalate privileges and bypass workspace isolation controls between user sessions. CISA specifically urged administrators to prioritize Langflow’s cross-tenant IDOR vulnerability first, noting that the flaw had already been patched to version 1.9.1 but remained unmitigated across countless active experimental workspaces still running older configurations.

The remediation window for U.S. federal entities was exceptionally aggressive, governed by Binding Operational Directive 26-04. Under that directive, agencies were required to remove all exposed instances of ColdFusion and the affected Joomla extensions from federal networks by July 10, 2026 — less than two full days after CISA formally recognized the active exploitation. Organizations operating outside government controls face an equally steep operational reality: actively exploited flaws rarely stay dormant once proof-of-concept code circulates, and threat actors typically focus their payload delivery on any environment that has not applied configuration mitigations or ingress filtering during that narrow window of exposure.

Sources

• CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV — The Hacker News
• CISA Urges Immediate Patching of Exploited ColdFusion, Langflow, Joomla Flaws — SecurityWeek