CISA Urges Patching of Four Actively Exploited ColdFusion, Langflow and Joomla Flaws
Summary
CISA warned that four ColdFusion, Langflow and Joomla flaws are being exploited. Federal agencies must patch them by July 10; the article gives vulnerability details, affected features and available fixes.
Key points
- CISA added the ColdFusion flaw CVE-2026-48282 and Langflow flaw CVE-2026-55255 to its Known Exploited Vulnerabilities catalog.
- CVE-2026-48282 is a path traversal flaw that can enable arbitrary code execution; Adobe released a patch on June 30.
- CVE-2026-55255 is a cross-tenant IDOR that can let attackers execute other users’ Langflow flows using a flow UUID; it was patched in version 1.9.1.
- Reported Langflow attacks harvested and replayed flow IDs, then chained CVE-2026-33017, an RCE flaw patched in March.
- The Joomla flaws CVE-2026-48908 in SP Page Builder and CVE-2026-56290 in Page Builder CK are unauthenticated file-upload or access-control issues that can lead to RCE.
- Reports say attackers exploited the Joomla flaws to plant hidden administrator accounts, a PHP file-manager backdoor and web shells; fixes are available in SP Page Builder 6.6.2 and Page Builder CK 3.6.0.
- Federal agencies are required to patch all four flaws by July 10; CISA advised other organizations to address KEV-listed vulnerabilities promptly.
Article Details
- Vulnerability Types
- Path traversal
- Cross-tenant insecure direct object reference (IDOR)
- Improper access control
- Unauthenticated arbitrary file upload
- Severity
- Critical; reported CVSS scores range from 9.9 to 10.0.
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1136 · Create AccountReports say threat actors planted hidden administrator accounts on Joomla websites.T1190 · Exploit Public-Facing ApplicationThreat actors exploited vulnerabilities in ColdFusion, Langflow, and Joomla extensions to execute code on affected systems.T1505.003 · Web ShellReports say threat actors deployed a PHP file manager backdoor and planted web shells on affected Joomla sites.
CVE
CVE-2026-33017host reconnaissance, harvested flow IDs, replayed the IDs to trigger the IDOR, and chained in CVE-2026-33017, a remote code execution (RCE) bug in Langflow that was patched in March.CVE-2026-48282Tracked as CVE-2026-48282 (CVSS score of 10/10), the ColdFusion bug was flagged as exploited only days after Adobe rolled out patches for it on June 30.CVE-2026-48908The SP Page Builder bug, tracked as CVE-2026-48908 (CVSS score of 10/10), is described as an improper access control issue that allows unauthenticated attackers to achieve RCE.CVE-2026-55255The Langflow security defect, tracked as CVE-2026-55255 (CVSS score of 9.9), is described as a cross-tenant insecure direct object reference (IDOR) weakness that allows attackers to execute flows belonging to otherCVE-2026-56290Tracked as CVE-2026-56290 (CVSS score of 10/10), the Page Builder CK bug is described as an unauthenticated arbitrary file upload issue leading to RCE on the underlying web server.
Vendors
AdobeThe US cybersecurity agency CISA on Tuesday warned that vulnerabilities in Adobe ColdFusion, Langflow, and two Joomla extensions have been exploited in the wild.JoomlackAdditionally, it warned that hackers have been exploiting two Joomla extension vulnerabilities, impacting SP Page Builder by JoomShaper and Page Builder CK by Joomlack.JoomShaperAdditionally, it warned that hackers have been exploiting two Joomla extension vulnerabilities, impacting SP Page Builder by JoomShaper and Page Builder CK by Joomlack.
Products
Adobe ColdFusionThe US cybersecurity agency CISA on Tuesday warned that vulnerabilities in Adobe ColdFusion, Langflow, and two Joomla extensions have been exploited in the wild.JoomlaThe US cybersecurity agency CISA on Tuesday warned that vulnerabilities in Adobe ColdFusion, Langflow, and two Joomla extensions have been exploited in the wild.LangflowThe US cybersecurity agency CISA on Tuesday warned that vulnerabilities in Adobe ColdFusion, Langflow, and two Joomla extensions have been exploited in the wild.Page Builder CKAdditionally, it warned that hackers have been exploiting two Joomla extension vulnerabilities, impacting SP Page Builder by JoomShaper and Page Builder CK by Joomlack.SP Page BuilderAdditionally, it warned that hackers have been exploiting two Joomla extension vulnerabilities, impacting SP Page Builder by JoomShaper and Page Builder CK by Joomlack.