CISA Adds Four Actively Exploited Flaws to KEV Catalog
Summary
CISA added four actively exploited flaws in Adobe ColdFusion, Joomlack Page Builder, Langflow and JoomShaper SP Page Builder to its KEV catalog. Reports describe code execution, web-shell uploads and Langflow credential theft; agencies face a July 10 patch deadline.
Key points
- CISA added four vulnerabilities affecting Adobe ColdFusion, Joomlack Page Builder, Langflow and JoomShaper SP Page Builder to its KEV catalog, citing evidence of active exploitation.
- CVE-2026-48282 is a path traversal flaw in Adobe ColdFusion that could enable arbitrary code execution. A security researcher told The Hacker News that an exploitation attempt was observed within hours of public disclosure.
- CVE-2026-48908 affects JoomShaper SP Page Builder; mySites.guru reported unauthenticated file uploads, PHP code execution and the appearance of a new Super User account. The article advises updating to version 6.6.2 or later.
- CVE-2026-56290 affects Joomlack Page Builder. mySites.guru reported exploitation to deliver web shells; the flaw was addressed in Page Builder CK version 3.6.0.
- CVE-2026-55255 is a Langflow authorization bypass that can let an authenticated attacker access another user's flows. Sysdig reported it being used alongside CVE-2026-33017 in a campaign, with the operator stealing LLM-provider and AWS keys; the final payload was unknown.
- Federal Civilian Executive Branch agencies were advised to apply fixes by July 10, 2026.
Article Details
- Vulnerability Types
- Path traversal
- Improper access control
- Authorization bypass through a user-controlled key (IDOR)
- Unrestricted file upload
- Remote code execution
- Severity
- Critical for CVE-2026-48282, CVE-2026-56290, and CVE-2026-48908 (CVSS 10.0); CVSS 6.1 for CVE-2026-55255.
- Affected Versions
- JoomShaper SP Page Builder versions before 6.6.2
- Page Builder CK versions before 3.6.0
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 103[.]207[.]14[.]220 | IP address geolocated to India from which an exploitation attempt against CVE-2026-48282 was recorded. |
| IPV4 | 45[.]207[.]216[.]55 | IP address identified by Sysdig as the operator exploiting Langflow vulnerabilities, including CVE-2026-55255 and CVE-2026-33017. |
MITRE ATT&CK
T1105 · Ingress Tool TransferPayloads deployed after CVE-2026-33017 exploitation were designed to fetch a second-stage downloader that delivered additional malware.T1190 · Exploit Public-Facing ApplicationThe article reports exploitation of internet-exposed Adobe ColdFusion, Joomla extensions, and Langflow applications through vulnerabilities.T1505.003 · Web ShellAttackers planted PHP web shells on susceptible sites, including a reported shell at /media/com_pagebuilderck/gfonts/bhup.php.
CVE
CVE-2025-3248The development makes it the latest Langflow flaw to be exploited by bad actors over the past year after CVE-2025-3248, CVE-2026-0770, CVE-2026-33017, CVE-2026-21445, CVE-2025-34291, and CVE-2026-5027.CVE-2026-33017month that it observed a lone operator (“45.207.216[.]55”) weaponizing the vulnerability along with CVE-2026-33017, an unauthenticated remote code execution flaw in Langflow, as part of a sustained campaign thatCVE-2026-48282CVE-2026-48282 in Adobe ColdFusion can lead to arbitrary code execution.CVE-2026-48908CVE-2026-48908 in JoomShaper SP Page Builder was abused to upload PHP code and create a Super User account.CVE-2026-55255Langflow CVE-2026-55255 enabled attackers to access other users’ flows and steal LLM and AWS keys.CVE-2026-56290CVE-2026-56290 in Joomlack Page Builder was used to deliver web shells on affected sites.
People
Vendors
Products
Adobe ColdFusionCISA has added four actively exploited vulnerabilities affecting Adobe ColdFusion, Joomlack Page Builder, Langflow, and JoomShaper SP Page Builder to its Known Exploited Vulnerabilities catalog.Joomlack Page BuilderCISA has added four actively exploited vulnerabilities affecting Adobe ColdFusion, Joomlack Page Builder, Langflow, and JoomShaper SP Page Builder to its Known Exploited Vulnerabilities catalog.JoomShaper SP Page BuilderCISA has added four actively exploited vulnerabilities affecting Adobe ColdFusion, Joomlack Page Builder, Langflow, and JoomShaper SP Page Builder to its Known Exploited Vulnerabilities catalog.LangflowCISA has added four actively exploited vulnerabilities affecting Adobe ColdFusion, Joomlack Page Builder, Langflow, and JoomShaper SP Page Builder to its Known Exploited Vulnerabilities catalog.Page Builder CKThe issue has been addressed in Page Builder CK version 3.6.0.