CISA Adds Three Exploited Vulnerabilities in JoomShaper, Langflow to KEV Catalog
CISA has added CVE-2026-48908, CVE-2026-55255, and CVE-2026-56290 to its Known Exploited Vulnerabilities (KEV) Catalog, citing active exploitation.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added three new vulnerabilities to its catalog of Known Exploited Vulnerabilities (KEV). The inclusion of these flaws, identified as CVE-2026-48908, CVE-2026-55255, and CVE-2026-56290, signifies that evidence of active exploitation has been observed in the wild, posing a significant risk to organizations.
CVE-2026-48908 specifically targets JoomShaper's SP Page Builder, an unrestricted file upload vulnerability that could allow attackers to upload dangerous file types. Another vulnerability, CVE-2026-55255, affects Langflow and involves an authorization bypass mechanism that can be exploited through a user-controlled key. The third addition, CVE-2026-56290, impacts Joomlack Page Builder and is categorized as an improper access control vulnerability.
These types of vulnerabilities are frequently leveraged by malicious cyber actors as an attack vector. Their inclusion in the KEV Catalog underscores the urgency for organizations to address them, particularly those operating within the federal government. CISA's Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize the remediation of vulnerabilities listed in the KEV Catalog, especially on publicly facing assets that could grant complete control of a system post-exploitation.
BOD 26-04 emphasizes a risk-based approach to vulnerability management, requiring agencies to focus on high-risk flaws first. This directive reinforces the critical role of the KEV Catalog in identifying and prioritizing the patching of vulnerabilities that pose the most immediate threat. The directive also outlines basic expectations for agencies to check for signs of compromise before applying patches, a crucial step in mitigating the impact of ongoing attacks.
While BOD 26-04 is specifically applicable to FCEB agencies, CISA strongly encourages all organizations, regardless of sector, to adopt similar risk-based vulnerability management practices. Prioritizing the remediation of vulnerabilities listed in the KEV Catalog is a proactive measure that can significantly enhance an organization's security posture against active threats.
CISA remains committed to continuously updating the KEV Catalog as new evidence of exploitation emerges. The agency relies on information from various sources to identify vulnerabilities that meet the criteria for inclusion, which include having a CVE ID, documented evidence of exploitation, and clear mitigation guidance.
Organizations that become aware of an exploited vulnerability not yet present in the KEV Catalog are encouraged to submit it for consideration through CISA's KEV Nomination Form. This collaborative effort helps ensure the catalog remains a comprehensive and up-to-date resource for the cybersecurity community, aiding in the collective defense against evolving cyber threats.
CISA has expanded its Known Exploited Vulnerabilities (KEV) catalog to include a critical path traversal flaw in Adobe ColdFusion, CVE-2026-48282, which carries a CVSS score of 10.0 and can lead to arbitrary code execution. This addition brings the total number of actively exploited vulnerabilities cataloged by CISA to four, with federal agencies mandated to patch these flaws by August 6, 2026.
CISA has now issued a specific directive, mandating federal agencies to patch the Langflow authentication bypass vulnerability, tracked as CVE-2024-31490, by Friday. This action underscores the critical nature of the flaw, which is already being actively exploited and allows unauthenticated attackers to execute arbitrary code within the AI development framework.
CISA has now also added a critical vulnerability in Adobe ColdFusion (CVE-2026-48282) to its Known Exploited Vulnerabilities catalog. This path traversal flaw, which allows for arbitrary code execution, was patched by Adobe on June 30 and carries a maximum CVSS score of 10/10. Federal agencies must patch this vulnerability by July 10, as exploitation in the wild has been confirmed.
The US Cybersecurity and Infrastructure Security Agency (CISA) has officially added CVE-2026-55255 to its Known Exploited Vulnerabilities (KEV) catalog, highlighting active exploitation in the wild. This vulnerability, an insecure direct object reference (IDOR) in Langflow's API, allows authenticated attackers to execute arbitrary flows belonging to other users by manipulating flow IDs. The Sysdig Threat Research Team observed this flaw being exploited alongside a remote code execution vulnerability (CVE-2026-33017), with attackers specifically targeting embedded credentials like API keys and cloud secrets within hijacked flows.