CISA adds ColdFusion, Langflow, and Joomla bugs to known exploited vulnerabilities list

The Cybersecurity and Infrastructure Security Agency (CISA) on July 7 added four bugs to its Known Exploited Vulnerabilities (KEV) catalog and told federal agencies to patch by July 10.

Three of the four bugs were critical — one from Adobe ColdFusion was CVSS 10.0, while the other two from Joomla were CVSS 9.8. The Langflow bug came in at CVSS 8.4, but was considered by some experts even more important because it deals with emerging AI workflows.

Security pros pointed out that each of the bugs had different risk profiles.

Denis Calderone, principal/CTO at Suzu Labs, said the Adobe ColdFusion web app development bug — CVE-2026-48282 — was of particular concern because it went from patch to exploitation in under two hours. Calderone said this one is a remote development service (RDS) FILE/IO handler flaw that results in a file traversal that lets an unauthenticated attacker write a webshell directly into the ColdFusion web root with a single HTTP request.

Calderone said KEVIntel caught live attacks on their honeypots the same day watchTowr published a technical breakdown. Calderone added that the one saving grace here is that teams must have Adobe’s RDS enabled for this to work.

“If your organization runs ColdFusion and you have not already patched to Update 10 (2025) or Update 21 (2023), stop reading and go do that,” said Calderone. “Then hunt your /CFIDE/ directories for unauthorized files. ColdFusion now has a track record that rivals Fortinet for repeat KEV appearances.”

On the Langflow bug, Calderone said his team believes that it’s likely the bigger concern. CVE-2026-55255 runs as an insecure direct object reference (IDOR) that lets any authenticated user execute another tenant's AI workflows, with all the secrets and credentials those flows hold.

“On its own, that’s bad,” said Calderone. “But the context makes it worse. Just last week, Sysdig published their research on JADEPUFFER, the first documented case of a fully agentic ransomware operation, and it used a Langflow instance as its initial access vector. That attack encrypted 1,342 production database records without a human ever touching the keyboard. These are critical infrastructure now, whether your org has classified them that way or not. Patch to 1.9.1, remove these from internet exposure, and audit what credentials your AI workflows are holding.”

Finally, Calderone said the two Joomla issues are related to a few extensions. Both SP Page Builder (CVE-2026-48908) and Page Builder CK (CVE-2026-56290) allow unauthenticated file upload to RCE, both are CVSS 10 and both being exploited.

“The challenge here is visibility,” said Calderone. “These are third-party Joomla plugins, and many site administrators do not have a clean inventory of which extensions are installed across their web properties. If you run Joomla anywhere in your environment, even a marketing microsite someone spun up three years ago, now’s the time to audit what plugins are active and whether they are current.”

Shane Barney, chief information security officer at Keeper Security, explained that the under two-hour timeline for the Adobe ColdFusion bug tells us that the attackers were already positioned and waiting, with new AI technologies making their attacks increasingly easier to execute. For any organization running ColdFusion in a federal or enterprise environment, this one’s a “drop-everything and patch” situation.

Barney agreed with Calderone that Langflow is the more concerning vulnerability. Barney said Langflow sits at the center of AI development pipelines: organizations use it to build and run AI agents, and those environments often hold cloud credentials, LLM API keys, and access to sensitive data flows.

“An attacker who compromises a Langflow deployment isn't just getting a foothold on a server, they're potentially harvesting privileged credentials and compute resources tied to AI infrastructure,” said Barney. “Threat actors have now chained multiple Langflow CVEs across successive months. This platform has become a sustained target, and security teams need to treat any Langflow deployment with access to production systems or cloud services as a privileged workload and govern it accordingly.”

Barney said the Joomla extension vulnerabilities are a lower-tier priority, affecting public-facing web infrastructure rather than core enterprise systems. The consequences, including planted backdoors and hidden administrator accounts, are serious, but Barney said the remediation path has been well-defined.

“Patch to the fixed versions, audit your file integrity and review admin account lists for anything that shouldn't be there,” said Barney. “The hard reality is that by the time patches are available, the vulnerability has often already been exploited. Modern privileged access management gives security teams continuous visibility into who has access to what across their environment, and the ability to detect and act on anomalous activity before the damage is done.”

Adrian Culley, solutions engineering lead, EMEA at SafeBreach, said CISA’s decision to add CVE-2026-48282 and CVE-2026-55255 to the KEV catalog — alongside the two Joomla extension flaws — underlines a pattern we keep seeing: patch windows are shrinking faster than patch cycles can move.

“The three-day remediation window CISA has given federal agencies is aggressive, but realistic for these severities,” said Culley. “Organizations running any of these four products should treat this as a today problem, and should be validating — not assuming — that mitigations actually hold against the observed TTPs, including the reconnaissance-to-IDOR-to-RCE chaining seen in the Langflow attacks.”

Matan Shavit, GM, North America at Hadrian, added that this one’s a classic dilemma all security teams face: vulnerabilities that have critical CVSS scores, but they do not all create the same level of real-world risk.

In this case, Shavit said the most urgent priority should be the three flaws that are likely to sit on externally accessible systems and can that attckers can exploit without authentication. If an attacker can find the system from the internet and does not need credentials to exploit it, given that there is active exploitation, teams should act on these now.

Shavit said teams should still patch Langflow, but it’s different from a triage perspective. The newly disclosed Langflow issue requires authentication and specific conditions to exploit, which Shavit said makes it less easily exploitable than an unauthenticated RCE against a public-facing web application.

“This is why CVSS alone is not enough,” said Shavit. “The base score tells teams how severe a vulnerability could be in theory, but exposure, authentication requirements, exploitability, and where the system sits in the environment tell them how dangerous it is in practice. The real value for security teams is understanding the context of their own environment. That context can make the difference between a bad day and a really bad day."