CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities include CVE-2026-48282, a path traversal flaw in Adobe ColdFusion with a CVSS score of 10.0 that could lead to arbitrary code execution; CVE-2026-56290, an improper access control vulnerability in Joomlack Page Builder (CVSS 10.0) allowing remote code execution via unauthenticated arbitrary file upload; CVE-2026-55255, an authorization bypass in Langflow (CVSS 6.1) enabling authenticated attackers to execute flows belonging to other users; and CVE-2026-48908, an unrestricted file upload vulnerability in JoomShaper SP Page Builder (CVSS 10.0) allowing unauthenticated users to upload and execute PHP code.

Exploitation of CVE-2026-48282 was observed within hours of public disclosure, with an attempt traced to an IP address in India. CVE-2026-48908 was exploited as a zero-day to upload a PHP file and create a Super User account. Users of SP Page Builder are advised to update to version 6.6.2 or later. Exploitation of CVE-2026-56290 has been recorded since June 27, 2026, to deliver web shells, and the issue is addressed in PageBuilder CK version 3.6.0. For CVE-2026-55255, Sysdig observed a lone operator weaponizing the flaw along with CVE-2026-33017 in a sustained campaign between June 22 and June 25, 2026, targeting Langflow instances for credential theft and cryptojacking. Federal Civilian Executive Branch (FCEB) agencies must apply fixes by July 10, 2026.