The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities affecting Adobe ColdFusion, Joomlack Page Builder, Langflow, and JoomShaper SP Page Builder to its Known Exploited Vulnerabilities (KEV) catalog. This directive mandates that federal agencies patch these vulnerabilities by July 10, 2026, to mitigate risks from active exploitation. Private organizations are also strongly encouraged to review the catalog and address these security weaknesses.
The newly cataloged vulnerabilities include CVE-2026-48282, a path traversal flaw in Adobe ColdFusion that can lead to arbitrary code execution without authentication. This critical vulnerability affects ColdFusion versions 2025.9, 2023.20, and earlier. Researchers noted that exploitation began within two hours of the vulnerability's public disclosure, with attacks originating from an IP address associated with India. Adobe had previously warned that this flaw was easy to exploit and likely to be used in attacks.
Also added is CVE-2026-48908, a vulnerability in JoomShaper SP Page Builder that allows attackers to upload malicious PHP files and establish new administrator accounts on affected websites. Another related issue, CVE-2026-56290, impacting Joomlack Page Builder, enables unauthenticated attackers to upload malicious files and achieve remote code execution. Website owners using SP Page Builder are advised to update to version 6.6.2 or later, and those using Page Builder CK should update to version 3.6.0 or later. They should also examine their upload and media directories for suspicious PHP files.
The KEV catalog now also lists CVE-2026-55255, an authorization bypass vulnerability in Langflow. This flaw allows an authenticated attacker to execute any flow belonging to another user by manipulating the flow ID in a request. Sysdig researchers observed exploitation of this vulnerability, along with CVE-2026-33017, between June 22 and June 25. Attackers combined these vulnerabilities to gain access to exposed servers, steal sensitive credentials such as LLM provider and AWS keys, and attempt to deploy additional malware. Sysdig noted that CVE-2026-55255, with a CVSS score of 9.9, was exploited after its lower-scored counterpart, CVE-2026-33017 (CVSS 9.3), had already been exploited thousands of times. The exploitation campaign is believed to be financially motivated, potentially for botnet or cryptojacking activities, highlighting AI orchestration platforms as attractive targets due to their sensitive data storage.
CISA's Binding Operational Directive 22-01 requires federal agencies to address vulnerabilities listed in the KEV catalog by their specified due dates to protect their networks. The inclusion of these four vulnerabilities underscores the agency's commitment to identifying and mitigating actively exploited security threats across various software platforms.
