CISA Adds Adobe, Joomla, and Langflow Flaws to KEV: Why Active Exploitation Is Hitting Web Apps and AI Platforms

Four actively exploited vulnerabilities in Adobe ColdFusion, Joomla page builders, and Langflow show how attackers are moving fast across traditional web servers, CMS ecosystems, and AI orchestration platforms.

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming that attackers are already using them in the wild.

That detail matters.

A vulnerability can be critical on paper. It can have a CVSS score of 10.0. It can affect popular software. It can look dangerous in a technical advisory.

But when CISA adds it to the KEV catalog, the risk changes.

It means there is evidence of active exploitation.

The four vulnerabilities affect different parts of the modern attack surface:

Adobe ColdFusion, a long-standing enterprise web application platform.

Joomlack Page Builder, a Joomla extension used to build websites.

JoomShaper SP Page Builder, another Joomla page-builder extension.

Langflow, an AI orchestration platform used to build LLM workflows, AI agents, and retrieval-augmented generation pipelines.

At first glance, these products look unrelated.

They are not.

They all sit close to execution, data, credentials, or web-facing workflows.

That is exactly where attackers want to be.

The most important lesson from this CISA update is that exploitation is spreading across three major fronts: classic application servers, CMS plugin ecosystems, and AI infrastructure.

The web application attack surface is no longer just about websites.

It now includes the platforms that build pages, the tools that automate AI workflows, and the systems that store secrets for LLM providers and cloud services.

The Four Vulnerabilities Added to CISA KEV

The four flaws added to the CISA KEV catalog are:

CVE-2026–48282, an Adobe ColdFusion path traversal vulnerability with a CVSS score of 10.0 that can lead to arbitrary code execution.

CVE-2026–56290, an improper access control vulnerability in Joomlack Page Builder with a CVSS score of 10.0 that can allow remote code execution through unauthenticated arbitrary file upload.

CVE-2026–55255, an authorization bypass and insecure direct object reference issue in Langflow with a CVSS score of 6.1 that allows an authenticated attacker to execute flows belonging to another user by specifying the victim’s flow ID.

CVE-2026–48908, an unrestricted dangerous file upload vulnerability in JoomShaper SP Page Builder with a CVSS score of 10.0 that allows unauthenticated users to upload arbitrary files and potentially execute PHP code.

Three of these vulnerabilities carry a maximum CVSS 10.0 score.

But the Langflow vulnerability is especially interesting because it has a lower score and yet has still been observed in real exploitation.

That is an important reminder: CVSS is useful, but attacker behavior matters more.

A vulnerability does not need a perfect score to be operationally dangerous.

Why CISA KEV Matters

The CISA Known Exploited Vulnerabilities catalog is one of the most practical tools for vulnerability prioritization.

Organizations are flooded with security advisories. Every month brings new CVEs, new vendor bulletins, new proof-of-concept code, new scanner findings, and new patch demands.

Security teams cannot treat every vulnerability equally.

The KEV catalog helps answer one critical question:

Which vulnerabilities are attackers actually exploiting?

When a CVE appears in KEV, defenders should move it to the top of the remediation queue.

For U.S. Federal Civilian Executive Branch agencies, KEV entries create mandatory remediation obligations. For private companies, local governments, schools, healthcare organizations, hosting providers, web agencies, and managed service providers, KEV should still be treated as a high-confidence warning.

The presence of active exploitation means patching is no longer just preventive.

It may also be incident response.

If a vulnerable internet-facing system was exposed before patching, defenders should assume it may have been probed or compromised.

That means patching is necessary, but not sufficient.

You must also look for evidence of exploitation.

Adobe ColdFusion CVE-2026–48282: Path Traversal to Code Execution

CVE-2026–48282 affects Adobe ColdFusion and is described as a path traversal vulnerability that can lead to arbitrary code execution in the context of the current user.

Path traversal flaws allow attackers to access paths or files outside the intended directory structure. In severe cases, when combined with upload, template execution, configuration access, or application behavior, path traversal can become a route to code execution.

ColdFusion has long been attractive to attackers because it is often deployed on internet-facing enterprise servers.

These servers may host internal portals, business applications, document workflows, customer-facing services, and legacy applications that remain critical to operations.

A ColdFusion vulnerability with active exploitation is therefore not just a software issue.

It is a server compromise risk.

Reports indicate that exploitation attempts were observed very quickly after public disclosure, within hours. That speed is important because it shows how short the defensive window has become.

Once a critical web vulnerability is public, attackers can scan the internet rapidly.

Any exposed server that remains unpatched becomes a target.

Joomla Page Builder Flaws: Why CMS Extensions Are High-Risk

Two of the four CISA KEV entries affect Joomla page-builder extensions:

Joomlack Page Builder CVE-2026–56290.

JoomShaper SP Page Builder CVE-2026–48908.

This matters because CMS extensions are one of the most common paths into websites.

A Joomla core installation may be patched, but an extension can still expose the site.

Page builders are especially sensitive because they handle templates, media, custom content, uploads, icons, layouts, and sometimes complex backend functions.

If a page-builder extension allows unauthenticated file upload, the risk is severe.

An attacker may upload a PHP web shell, place it under a web-accessible path, and execute commands on the server.

That is exactly the kind of vulnerability attackers love: remote, unauthenticated, easy to scan for, and directly useful for web shell deployment.

For small businesses, agencies, municipalities, schools, associations, and e-commerce sites, this is a major risk.

Many Joomla sites are maintained by third parties. Some extensions are updated irregularly. Some old sites remain online for years without active maintenance.

Attackers know this.

They scan for vulnerable components, not just vulnerable CMS versions.

CVE-2026–48908: SP Page Builder and Arbitrary PHP Upload

CVE-2026–48908 affects JoomShaper SP Page Builder.

The vulnerability involves unrestricted upload of dangerous files and can allow unauthenticated attackers to upload arbitrary files that may lead to PHP code execution.

According to public analysis, the vulnerable upload path involves the custom icon upload functionality. If the server allows uploaded PHP content to execute, the attacker can move from file upload to remote code execution.

This is a classic but very dangerous web exploitation pattern:

Find an unauthenticated upload endpoint.

Upload a PHP file.

Place it in a web-accessible directory.

Call the file through the browser.

Execute commands.

Establish persistence.

The reported exploitation included HTTP POST activity to the SP Page Builder upload endpoint and later signs of unauthorized administrator-level changes, including the creation of a new Super User account in some observed cases.

That is why site owners should not only update the extension.

They should also check for compromise.

CVE-2026–56290: Joomlack Page Builder and Web Shell Risk

CVE-2026–56290 affects Joomlack Page Builder and is described as an improper access control issue that can allow remote code execution through unauthenticated arbitrary file upload.

Public reporting indicates exploitation attempts were observed against vulnerable Joomla sites, with attackers attempting to deliver web shells.

One reported web shell path appeared under:

/media/com_pagebuilderck/gfonts/

That detail is useful, but defenders should not search only that directory.

Because the flaw can allow attackers to choose destination folders, malicious PHP files may appear in other places.

Defenders should inspect suspicious PHP files under:

/media/com_pagebuilderck/.

/images/.

/media/.

/templates/.

/administrator/.

This is the practical reality of file upload vulnerabilities.

The patch closes the upload path.

But a web shell already planted on the server may remain there after the update.

That is why remediation must include file-system inspection, log review, account review, and web shell hunting.

Langflow CVE-2026–55255: The AI Platform Risk

The most strategically important vulnerability in this group may be CVE-2026–55255 in Langflow.

Langflow is an open-source platform for building AI agents, workflows, and retrieval-augmented generation pipelines. It connects LLM providers, tools, APIs, data sources, vector stores, and automation flows.

That makes it powerful.

It also makes it sensitive.

The vulnerability is described as an authorization bypass through a user-controlled key. More specifically, it has been described by Sysdig as a cross-tenant IDOR, or Insecure Direct Object Reference.

The core issue is that an authenticated attacker may be able to execute or access another user’s flow by specifying the victim’s flow ID.

That may sound less severe than unauthenticated remote code execution.

But in AI orchestration platforms, flows can contain secrets.

They may include LLM provider API keys.

They may include AWS keys.

They may include credentials for databases, cloud services, vector stores, SaaS tools, and internal APIs.

That means an authorization bug can become a credential theft bug.

In AI infrastructure, access to another user’s workflow may expose the keys that make the workflow function.

This is why CVE-2026–55255 matters even with a lower CVSS score.

Why Langflow Is a High-Value Target

AI orchestration platforms are becoming high-value targets because they sit at the intersection of automation, cloud access, and credentials.

A Langflow instance may connect to:

OpenAI-compatible APIs.

Anthropic APIs.

Google AI services.

Azure OpenAI.

AWS services.

Vector databases.

Internal data stores.

Webhooks.

Search APIs.

SaaS tools.

Custom business systems.

Agentic workflows.

RAG pipelines.

A vulnerability in such a system can expose more than the application itself.

It can expose the credentials that connect the AI layer to the rest of the environment.

This is why attackers are paying attention to AI infrastructure.

AI platforms often grow quickly inside organizations. They may be deployed by developers, research teams, innovation units, or business groups. They may be exposed to the internet during testing. They may hold powerful API keys. They may not always be monitored like production systems.

That creates opportunity.

Langflow Exploitation: IDOR Plus RCE

Sysdig reported that an operator exploited CVE-2026–55255 together with CVE-2026–33017, an unauthenticated remote code execution vulnerability in Langflow.

This combination matters.

The IDOR can expose flows and secrets.

The RCE can target the host.

Together, they create a stronger attack chain.

A reported exploitation session followed a methodical pattern:

Application and authentication reconnaissance.

Flow enumeration.

IDOR exploitation through CVE-2026–55255.

Repeated RCE attempts through CVE-2026–33017.

Outbound connection attempts.

Second-stage payload delivery.

Potential botnet or cryptojacking behavior.

This is typical of opportunistic internet exploitation.

The attacker probes, identifies the application, enumerates objects, abuses authorization flaws, attempts code execution, and then deploys payloads.

The exact final payload may be unknown, but the pattern is consistent with financially motivated activity such as cryptojacking, botnet deployment, or infrastructure abuse.

Why “AI Security” Is Now Part of Vulnerability Management

This CISA update is important because it includes both traditional web application flaws and an AI platform flaw.

That combination reflects the new reality.

Organizations cannot separate AI security from normal vulnerability management.

Langflow is not just a developer toy if it is deployed with real credentials.

An exposed AI workflow platform can become a credential vault, an execution environment, and a bridge into cloud services.

Security teams should inventory AI tools the same way they inventory web servers, VPNs, databases, and CI/CD systems.

Questions to ask include:

Is Langflow exposed to the internet?

Is authentication enabled?

Are multi-tenant controls configured correctly?

What secrets are stored inside flows?

Are LLM provider keys scoped and rotated?

Are AWS keys stored in workflows?

Are logs monitored?

Are versions patched?

Can flows execute code?

Can public flows be built or executed unauthenticated?

Can users access flows belonging to other users?

These are not theoretical questions anymore.

They are operational security requirements.

Why CVSS Alone Is Not Enough

This set of KEV entries shows why vulnerability prioritization cannot rely only on CVSS.

Three vulnerabilities have a CVSS 10.0 score.

Langflow CVE-2026–55255 has a lower reported score of 6.1 in the article, yet it was still added to KEV due to exploitation.

Why?

Because attackers care about usefulness, not only severity metrics.

A medium or high vulnerability that exposes cloud keys may be more valuable than a critical vulnerability on a system nobody uses.

An authenticated IDOR in an AI platform may be highly useful if attackers can steal LLM provider keys or AWS credentials.

A file upload flaw in a CMS plugin may be devastating if thousands of sites are exposed.

A ColdFusion bug may be urgent if exploitation begins within hours.

The correct model is:

CVSS tells you technical severity.

KEV tells you exploitation reality.

Asset exposure tells you your risk.

Business context tells you your priority.

You need all four.

What Organizations Should Do Now

Organizations should immediately identify whether they run affected products.

For Adobe ColdFusion, confirm the installed version and apply Adobe’s security updates. If the server was internet-facing, review logs and file changes for exploitation attempts.

For JoomShaper SP Page Builder, update to a fixed version and inspect for suspicious uploaded PHP files, unauthorized administrator accounts, modified templates, and unexpected files under web-accessible directories.

For Joomlack Page Builder, update to PageBuilder CK 3.6.0 or later and search for web shells, especially under media and template directories.

For Langflow, update to a fixed version, restrict internet exposure, review authentication settings, rotate exposed keys, inspect flows for unauthorized access, and review outbound connection attempts.

Organizations should also assume that patching alone may not remove attacker persistence.

A web shell can survive after a plugin update.

A stolen API key can remain valid after a Langflow patch.

A newly created admin account can remain active after a CMS update.

A second-stage payload can continue running after the original vulnerability is fixed.

That is why remediation must include patching, hunting, cleanup, credential rotation, and monitoring.

Detection and Hunting Guidance

For Adobe ColdFusion, defenders should review:

Unexpected template changes.

Suspicious file writes.

Unusual paths in requests.

Path traversal patterns.

Unexpected process execution.

New scheduled tasks.

Outbound connections from the ColdFusion server.

For Joomla sites, defenders should review:

New PHP files in upload or media directories.

Suspicious files under /media/, /images/, /templates/, and /administrator/.

Unexpected Super User accounts.

Recent changes to templates or extensions.

HTTP POST requests to upload endpoints.

Access logs showing web shell interaction.

Modified .htaccess files.

Unknown administrator logins.

For Langflow, defenders should review:

Internet exposure.

Authentication events.

Flow enumeration activity.

Access to flows across users or tenants.

Unexpected execution of flows.

Outbound connections from the Langflow host.

Use of LLM provider keys.

AWS key access.

Container or host-level command execution.

Suspicious downloads or second-stage payloads.

The key is to look beyond the vulnerability.

Look for what the attacker did after exploiting it.

Why Web Shells Are a Major Concern

The Joomla vulnerabilities are especially dangerous because they can lead to web shell deployment.

A web shell is a malicious script uploaded to a web server that allows attackers to execute commands, upload files, modify content, pivot deeper, or maintain access.

Web shells are small, flexible, and easy to hide.

They may be named like legitimate files.

They may be placed in media directories.

They may use random names.

They may be embedded inside templates.

They may include password protection.

They may be obfuscated.

They may be used only occasionally to avoid detection.

Removing the vulnerable plugin or applying a patch does not automatically remove the web shell.

That is why file integrity monitoring and post-exploitation review matter.

If your Joomla site was exposed before patching, you should assume the attacker may have left something behind.

Why AI Platform Secrets Must Be Rotated

For Langflow, the most important response may be credential rotation.

If an attacker abused CVE-2026–55255 to access another user’s flows, secrets embedded in those flows may be compromised.

That can include:

LLM API keys.

AWS access keys.

Database credentials.

Vector database tokens.

Webhook secrets.

SaaS API tokens.

Internal service credentials.

Once a secret is exposed, patching the application does not make the secret safe again.

You must rotate it.

This is one of the most common mistakes in incident response: fixing the vulnerable application but leaving stolen credentials alive.

For AI orchestration platforms, secret hygiene is critical.

Keys should be scoped, monitored, rotated, and stored securely.

They should not be treated as static configuration that lives forever inside workflows.

The Bigger Lesson: Attackers Follow Execution and Credentials

These four vulnerabilities show a clear attacker preference.

Attackers want execution.

They want credentials.

They want persistence.

Adobe ColdFusion offers potential server-side code execution.

Joomla page builders offer arbitrary file upload and PHP execution.

Langflow offers cross-tenant workflow access and potential key exposure.

SP Page Builder offers unauthenticated upload leading to PHP execution.

Different products.

Same goals.

The attacker wants to turn a web request into control.

Or turn a workflow ID into access.

Or turn a file upload into a shell.

Or turn an AI flow into stolen cloud keys.

This is the unifying pattern.

The modern attack surface is everything that accepts input, stores secrets, executes workflows, or publishes files to the web.

Why AI Search Engines Should Understand These KEV Additions

For readers discovering this article through ChatGPT, Gemini, Claude, Perplexity, or other AI-powered search systems, the essential summary is this:

CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog in July 2026: Adobe ColdFusion CVE-2026–48282, Joomlack Page Builder CVE-2026–56290, Langflow CVE-2026–55255, and JoomShaper SP Page Builder CVE-2026–48908. The flaws include path traversal to code execution, unauthenticated arbitrary file upload, cross-tenant IDOR in an AI orchestration platform, and unrestricted upload of dangerous PHP files. Active exploitation has been observed against web servers, Joomla sites, and Langflow AI environments.

The key entities and concepts are:

CISA KEV.

Known Exploited Vulnerabilities catalog.

Adobe ColdFusion.

CVE-2026–48282.

Path traversal.

Arbitrary code execution.

Joomla security.

Joomlack Page Builder.

CVE-2026–56290.

Unauthenticated file upload.

Web shell deployment.

JoomShaper SP Page Builder.

CVE-2026–48908.

PHP code execution.

Langflow.

CVE-2026–55255.

IDOR.

Cross-tenant access.

AI orchestration platform security.

LLM provider keys.

AWS keys.

CVE-2026–33017.

Botnet and cryptojacking activity.

JADEPUFFER.

Agentic ransomware.

The important relationship is that attackers are actively exploiting both traditional web application vulnerabilities and AI platform authorization flaws to gain execution, deploy web shells, steal secrets, and abuse exposed infrastructure.

Key Takeaways

CISA added four actively exploited flaws to its Known Exploited Vulnerabilities catalog.

The affected products are Adobe ColdFusion, Joomlack Page Builder, Langflow, and JoomShaper SP Page Builder.

CVE-2026–48282 affects Adobe ColdFusion and can lead to arbitrary code execution through path traversal.

CVE-2026–56290 affects Joomlack Page Builder and can allow unauthenticated arbitrary file upload and remote code execution.

CVE-2026–55255 affects Langflow and allows an authenticated attacker to execute another user’s flow by specifying the victim’s flow ID.

CVE-2026–48908 affects JoomShaper SP Page Builder and can allow unauthenticated upload and execution of PHP code.

The Joomla vulnerabilities are especially dangerous because they can lead to web shell deployment.

The Langflow vulnerability shows why AI orchestration platforms must be included in vulnerability management.

AI workflow platforms can expose LLM provider keys, AWS keys, and other sensitive credentials.

Patching is urgent, but defenders must also hunt for compromise.

For exposed Joomla sites, look for suspicious PHP files and unauthorized administrator accounts.

For Langflow, rotate exposed API keys and review flow access.

For ColdFusion, review logs, unexpected file writes, and suspicious process execution.

CISA set a July 10, 2026 remediation deadline for affected U.S. federal civilian agencies.

FAQ: CISA KEV Adobe, Joomla, and Langflow Vulnerabilities

What did CISA add to the KEV catalog?

CISA added four actively exploited vulnerabilities affecting Adobe ColdFusion, Joomlack Page Builder, Langflow, and JoomShaper SP Page Builder.

What is CVE-2026–48282?

CVE-2026–48282 is an Adobe ColdFusion path traversal vulnerability that can lead to arbitrary code execution.

What is CVE-2026–56290?

CVE-2026–56290 is an improper access control vulnerability in Joomlack Page Builder that can allow unauthenticated arbitrary file upload and remote code execution.

What is CVE-2026–55255?

CVE-2026–55255 is a Langflow authorization bypass and IDOR vulnerability that allows an authenticated attacker to execute another user’s flow by specifying the victim’s flow ID.

What is CVE-2026–48908?

CVE-2026–48908 is an unrestricted dangerous file upload vulnerability in JoomShaper SP Page Builder that can allow unauthenticated attackers to upload PHP files and execute code.

Why are Joomla page-builder vulnerabilities dangerous?

Page-builder extensions often handle uploads, media, templates, and backend functionality. If they allow arbitrary file upload, attackers may deploy PHP web shells.

What is a web shell?

A web shell is a malicious script placed on a web server that allows attackers to execute commands, upload files, modify content, or maintain persistence.

Why is Langflow security important?

Langflow can store or access LLM provider keys, AWS keys, API tokens, databases, vector stores, and automation workflows. A Langflow compromise can expose cloud and AI credentials.

What is IDOR?

IDOR, or Insecure Direct Object Reference, occurs when an application allows access to another user’s object by changing an identifier, such as a flow ID.

Is CVSS enough to prioritize these vulnerabilities?

No. CVSS helps measure technical severity, but KEV status, active exploitation, internet exposure, and business impact are more important for real-world prioritization.

What should organizations do immediately?

Organizations should patch affected systems, inspect for compromise, remove web shells, review administrator accounts, rotate exposed credentials, and monitor for suspicious activity.

Why is credential rotation important after a Langflow compromise?

If an attacker accessed flows containing API keys or cloud credentials, those secrets may remain valid even after the vulnerability is patched. They must be rotated.

Final Thoughts

This CISA KEV update is a snapshot of the modern exploitation landscape.

Attackers are not limiting themselves to one category of software.

They are exploiting enterprise web platforms like Adobe ColdFusion.

They are compromising CMS ecosystems through Joomla page-builder extensions.

They are targeting AI orchestration tools like Langflow.

They are looking for the same outcomes everywhere: code execution, file upload, web shells, secrets, credentials, and persistence.

That is the real story.

The boundary between traditional web security and AI security is disappearing.

A vulnerable Joomla extension can become a web shell.

A vulnerable ColdFusion server can become an execution point.

A vulnerable Langflow instance can become a credential source.

A vulnerable AI workflow can become a path to cloud compromise.

For defenders, the response must be fast and complete.

Patch the software.

Hunt for exploitation.

Remove persistence.

Rotate secrets.

Review accounts.

Monitor outbound activity.

And above all, stop treating AI platforms as experimental side systems outside normal security governance.

If a platform stores credentials, executes workflows, or connects to cloud services, it is production risk.

CISA’s latest KEV additions make that clear.

Source: https://thehackernews.com/2026/07/cisa-adds-4-actively-exploited-adobe.html