CISA Flags Four Actively Exploited Flaws

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on July 8, 2026, all with confirmed active exploitation. Three carry the maximum CVSS score of 10.0. The affected products are Adobe ColdFusion, two competing Joomla page builders, and Langflow, an open-source AI orchestration platform. Federal Civilian Executive Branch agencies have until July 10, 2026 to remediate.

The common thread is speed and low barrier to entry. Two of these flaws allow unauthenticated remote code execution via file upload. One ColdFusion flaw was exploited within hours of public disclosure. If you run any of these products, treat this as an emergency patch cycle, not a scheduled one.

The four flaws

• CVE-2026-48282 (CVSS 10.0) — Path traversal in Adobe ColdFusion leading to arbitrary code execution in the current user context.
• CVE-2026-56290 (CVSS 10.0) — Improper access control in Joomlack Page Builder (Page Builder CK) enabling unauthenticated arbitrary file upload and RCE.
• CVE-2026-48908 (CVSS 10.0) — Unrestricted dangerous file upload in JoomShaper SP Page Builder allowing unauthenticated PHP upload and execution.
• CVE-2026-55255 (CVSS 6.1) — Cross-tenant IDOR in Langflow letting an authenticated attacker run another user's flow by supplying the victim's flow ID.

ColdFusion: exploited within hours

CVE-2026-48282 went from disclosure to exploitation attempt in a matter of hours. Ryan Dewhurst, founder of KEVIntel, told The Hacker News an attempt was logged from an IP geolocated to India (103.207.14.220). Path traversal to code execution in an enterprise app server is a well-worn attacker playbook, and ColdFusion has been a repeat KEV entry. Apply Adobe's update and audit for any traversal patterns hitting file endpoints since the disclosure date.

Two Joomla page builders, two web shells

CVE-2026-48908 in SP Page Builder was exploited as a zero-day. Attackers sent an HTTP POST to index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon to drop a PHP file, then a new Super User account appeared, per mySites.guru. That account creation is the tell: full administrative persistence beyond the initial shell. Update to SP Page Builder 6.6.2 or later and audit your Super User list immediately.

CVE-2026-56290 in Page Builder CK saw exploitation from June 27, 2026 to deliver web shells. Because the flaw lets the attacker choose the destination folder, planted files can land anywhere. mySites.guru caught the first confirmed shell at /media/com_pagebuilderck/gfonts/bhup.php, an uploader keyed on a $_POST['_upl'] field. Fixed in Page Builder CK 3.6.0.

Langflow: the AI platform as a credential vault

CVE-2026-55255 is the lower-scored flaw at 6.1, but the campaign around it is the most instructive. Sysdig observed a lone operator (45.207.216.55) chaining it with CVE-2026-33017, an unauthenticated RCE, against an exposed Langflow instance between June 22 and June 25, 2026. The session was methodical: auth reconnaissance, flow enumeration, the CVE-2026-55255 IDOR, then a sustained loop of the RCE with outbound connection attempts.

The IDOR is a cross-tenant insecure direct object reference. The operator used it to steal LLM provider keys and AWS keys from other tenants' flows. As Sysdig put it, the RCE went after the host while the IDOR went after other tenants' credentials. AI orchestration platforms concentrate exactly the secrets attackers want, and this operator knew it. The activity is assessed as opportunistic and financially motivated, consistent with botnet and cryptojacking staging, though the final payload is unconfirmed.

What to do before July 10

• Patch: SP Page Builder 6.6.2+, Page Builder CK 3.6.0+, plus vendor updates for Adobe ColdFusion and Langflow.
• Assume compromise on exposed systems. Hunt for web shells, rogue Super User accounts, and anomalous outbound connections.
• Rotate any credentials stored in Langflow, especially LLM provider and AWS keys, and check CloudTrail for unauthorized use.
• Remove Langflow and CMS admin interfaces from direct internet exposure; put them behind VPN or IP allowlists.
• FCEB agencies must remediate by July 10, 2026; everyone else should treat that as the target too.

The pattern here is consistent: critical file-upload and traversal flaws in widely deployed web software, weaponized fast by opportunistic operators. The Langflow case is the forward-looking warning. As AI orchestration platforms accumulate credentials and automation capability, they become high-value targets for both credential theft and fully automated extortion.