CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV

1. Executive summary

On 2026-07-07, CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, all with confirmed evidence of active exploitation: CVE-2026-48282 (Adobe ColdFusion, CVSS 10.0 CRITICAL, CWE-22 Path Traversal), CVE-2026-56290 (Joomlack Page Builder, CVSS 10.0), CVE-2026-55255 (Langflow, CVSS 6.1), and CVE-2026-48908 (JoomShaper SP Page Builder, CVSS 10.0). CVE-2026-48282 was exploited within hours of public disclosure — watchTowr published a technical analysis on 2026-07-02 and KEVIntel honeypot sensors recorded exploitation attempts minutes later from IP 103.207.14[.]220. EMEA financial services running Adobe ColdFusion for external-facing applications, or Joomla-based marketing/portal sites, face immediate risk of unauthenticated remote code execution. The Langflow IDOR (CVE-2026-55255) is relevant to institutions experimenting with AI orchestration platforms that may expose LLM provider keys and AWS credentials.

2. Regulatory framing

3. Technical analysis & attack chain

CVE-2026-48282 — Adobe ColdFusion Path Traversal (CVSS 10.0, CWE-22)

Verified reference data: CVSS 10.0 CRITICAL, IN CISA KEV (added 2026-07-07), EPSS 1%, CWE-22 (Path Traversal).

Patch timeline: Adobe patched CVE-2026-48282 on 2026-06-30 as part of a broader ColdFusion update. On 2026-07-02, watchTowr researchers published a technical analysis of this and other recently fixed ColdFusion flaws. KEVIntel honeypot sensors detected exploitation attempts within minutes of that publication, from IP address 103.207.14[.]220, geolocated to India.

Vulnerability mechanism: Path traversal (CWE-22) in Adobe ColdFusion enabling arbitrary code execution in the context of the current user. The specific affected versions and traversal path sequences are not detailed in the available source material. The BSI advisory (WID-SEC-2026-1858) corroborates that multiple ColdFusion vulnerabilities allow arbitrary code execution, privilege escalation, security bypass, sensitive data disclosure, and XSS.

Attack chain (confirmed steps)

1. Attacker sends crafted path traversal request to an internet-exposed Adobe ColdFusion instance.
2. Traversal escapes intended directory boundaries, enabling access to arbitrary files on the server.
3. Attacker achieves arbitrary code execution in the context of the current user (the ColdFusion service account).

Confidence caveat: The specific traversal payload, affected ColdFusion versions, and post-exploitation behaviour are not available in the provided sources. The IP 103.207.14[.]220 is single-sourced (KEVIntel via The Hacker News); verify before enforcement.

CVE-2026-56290 — Joomlack Page Builder Improper Access Control (CVSS 10.0)

Vulnerability mechanism: Improper access control in Joomlack Page Builder (Joomla extension) allowing unauthenticated arbitrary file upload leading to remote code execution.

Attack chain (confirmed steps)

1. Unauthenticated attacker sends a crafted file upload request to a Joomla site running the vulnerable Page Builder CK extension.
2. Uploaded file (PHP web shell) is written to the target filesystem. The flaw allows the attacker to choose the destination folder.
3. First confirmed web shell observed at /media/com_pagebuilderck/gfonts/bhup.php — an uploader shell keyed on a $_POST['_upl'] field.
4. Attacker accesses the web shell to execute arbitrary PHP code on the server.

Exploitation evidence: mySites.guru recorded exploitation efforts as of 2026-06-27. Because the flaw lets the attacker pick the destination folder, planted files could be anywhere — not just obvious upload directories. Recommended search paths: /media/com_pagebuilderck/ first, then more widely under /images, /media, /templates, and /administrator.

Remediation: Update to Page Builder CK version 3.6.0 or later.

Confidence caveat: Exploitation details and web shell artefacts are single-sourced (mySites.guru via The Hacker News).

CVE-2026-48908 — JoomShaper SP Page Builder Unrestricted File Upload (CVSS 10.0)

Vulnerability mechanism: Unrestricted upload of a file with a dangerous type in JoomShaper SP Page Builder, allowing unauthenticated users to upload arbitrary files resulting in execution of PHP code.

Attack chain (confirmed steps)

1. Unauthenticated attacker sends an HTTP POST request to the endpoint index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon.
2. A PHP file is uploaded to the server via this endpoint.
3. The uploaded PHP file is executed, providing remote code execution.
4. Post-exploitation: a new Super User account appears on the Joomla instance, indicating privilege escalation to full administrative access.

Exploitation evidence: Exploited as a zero-day prior to patch availability. Observed by mySites.guru.

Remediation: Update to SP Page Builder version 6.6.2 or later.

Confidence caveat: Exploitation details are single-sourced (mySites.guru via The Hacker News).

CVE-2026-55255 — Langflow Authorization Bypass / IDOR (CVSS 6.1)

Vulnerability mechanism: Authorization bypass through a user-controlled key in Langflow. An authenticated attacker can execute any flow belonging to another user by specifying the victim's flow ID in the request. Sysdig characterises this as a cross-tenant insecure direct object reference (IDOR).

Attack chain (confirmed steps)

1. A lone operator (IP 45.207.216[.]55) probed an internet-exposed Langflow instance beginning 2026-06-22.
2. On 2026-06-25, the operator conducted a methodical session: application/auth reconnaissance → flow enumeration → CVE-2026-55255 IDOR exploitation → sustained loop of CVE-2026-33017 (unauthenticated RCE in Langflow) with outbound connection attempts.
3. The IDOR was used to access other tenants' flows and steal LLM provider keys and AWS keys.
4. The RCE (CVE-2026-33017) was used to target the host: deployment of payloads designed to fetch a second-stage downloader responsible for delivering additional malware.
5. The attack chain is consistent with botnet and cryptojacking attacks. The exact nature of the final payload is unknown.

Attribution: No named threat actor or MITRE ATT&CK profile is associated with this activity. Sysdig assesses the activity as opportunistic and financially motivated. Attribution is unconfirmed.

Confidence caveat: The Langflow campaign details are single-sourced (Sysdig via The Hacker News). The IP 45.207.216[.]55 should be verified before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

CVE-2026-48282 (Adobe ColdFusion)

• Identify all internet-facing and internal Adobe ColdFusion instances. The patch was released 2026-06-30; any instance not updated since that date is vulnerable.
• If patching cannot be completed immediately, isolate or disable external access to ColdFusion administrator interfaces and application endpoints. Place ColdFusion behind a WAF with path traversal filtering rules.
• Review web server and ColdFusion application logs for anomalous path traversal patterns (e.g., ../ sequences, encoded traversal characters %2e%2e%2f, %2e%2e/, ..%2f) dating back to at least 2026-07-02.
• Block IP 103.207.14[.]220 at perimeter firewall and EDR.

CVE-2026-56290 (Joomlack Page Builder CK)

• Update Page Builder CK to version 3.6.0 or later on all Joomla sites.
• Search for web shells across the filesystem, prioritising: /media/com_pagebuilderck/, then /images, /media, /templates, /administrator. Look for stray PHP files, particularly any containing $_POST['_upl'].
• Disable or remove the Page Builder CK extension if the patch cannot be applied immediately.

CVE-2026-48908 (JoomShaper SP Page Builder)

• Update SP Page Builder to version 6.6.2 or later on all Joomla sites.
• Review Joomla user lists for unexpected Super User accounts created on or before the patch date.
• Block HTTP POST requests to index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon at the WAF/reverse proxy as a containment measure if patching is delayed.
• Disable or remove the SP Page Builder extension if the patch cannot be applied immediately.

CVE-2026-55255 (Langflow)

• Identify all Langflow instances, particularly any exposed to the internet.
• Restrict network access to Langflow instances: no direct internet exposure. Place behind VPN or authenticated reverse proxy.
• Block IP 45.207.216[.]55 at perimeter firewall.
• Rotate any LLM provider API keys and AWS credentials that may have been accessible through Langflow flows.
• Also assess for CVE-2026-33017 (unauthenticated RCE in Langflow), which was chained with this vulnerability in the observed campaign.

P2 — Within 72 hours

• Conduct a full filesystem scan of all Joomla and ColdFusion servers for PHP web shells and unexpected files. Focus on non-standard directories given the arbitrary destination folder capability in CVE-2026-56290.
• Audit all Joomla Super User and administrative accounts for illegitimate entries; remove any unauthorised accounts.
• Review ColdFusion application logs, IIS/Apache access logs, and WAF logs for exploitation indicators from 2026-06-30 onward.
• For Langflow: audit flow access logs for cross-tenant access patterns (one user accessing flows owned by another). Review outbound connection logs from Langflow hosts for second-stage downloader activity.
• Verify all four vulnerabilities are added to internal vulnerability management dashboards and patch verification workflows.

P3 — Within 7 days

• Ensure all Adobe ColdFusion instances are running the latest patched version and that automatic security updates are enabled where feasible.
• Implement WAF rules to block path traversal attempts against ColdFusion endpoints as defence-in-depth.
• For Joomla estates: audit all installed extensions for known vulnerabilities and establish a patch cadence. Both exploited Joomla vulnerabilities were in page builder extensions — review whether these are necessary on production sites.
• For Langflow: implement network segmentation to isolate AI orchestration platforms from production networks. Ensure credential storage in Langflow flows follows least-privilege principles and consider using short-lived tokens rather than static API keys.
• Validate remediation through internal penetration testing or authenticated vulnerability scanning.

5. Indicators of compromise

ipv4  103.207.14[.]220
ipv4  45.207.216[.]55
filepath  /media/com_pagebuilderck/gfonts/bhup.php
filepath  /media/com_pagebuilderck/
filepath  /images/
filepath  /media/
filepath  /templates/
filepath  /administrator/
http-endpoint  index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon
string  $_POST['_upl']

6. Detection

rule Joomlack_PageBuilderCK_Webshell_BHUP {
  meta:
    author = "Adverse Trace"
    date = "2026-07-08"
    reference = "https://thehackernews.com/2026/07/cisa-adds-4-actively-exploited-adobe.html"
    description = "Detects web shell deployed via CVE-2026-56290 Joomlack Page Builder CK exploitation"
  strings:
    $upload_field = "$_POST['_upl']" ascii
    $path_marker = "com_pagebuilderck" ascii
    $gfonts_path = "gfonts/bhup.php" ascii
  condition:
    2 of them
}

title: Suspicious PHP File Upload to JoomShaper SP Page Builder Custom Icon Endpoint
id: 7a3c1f2e-2026-4890-abcd-001122334455
status: experimental
description: Detects HTTP POST requests to the SP Page Builder asset upload endpoint exploited in CVE-2026-48908
author: Adverse Trace
date: 2026/07/08
references:

  - https://thehackernews.com/2026/07/cisa-adds-4-actively-exploited-adobe.html
logsource:
  category: webserver
  product: apache/nginx/iis
detection:
  selection:
    c-uri|contains:

      - "index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon"
    http_method: POST
  condition: selection
fields:

  - src_ip
  - dst_ip
  - c-uri
  - http_user_agent
  - http_request_body
falsepositives:

  - Legitimate administrator uploading custom icons via SP Page Builder (should be rare and from known admin IPs)
level: high

title: Suspicious PHP File Creation in Joomla Media Directories
id: 8b4d2a3f-2026-5629-ef01-001122334455
status: experimental
description: Detects creation of PHP files in Joomla directories targeted by CVE-2026-56290 web shell deployment
author: Adverse Trace
date: 2026/07/08
references:

  - https://thehackernews.com/2026/07/cisa-adds-4-actively-exploited-adobe.html
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|contains:

      - "/media/com_pagebuilderck/"
      - "/images/"
      - "/templates/"
    TargetFilename|endswith:

      - ".php"
  filter_legitimate:
    Image|contains:

      - "/usr/sbin/php"
      - "/usr/bin/php"
  condition: selection and not filter_legitimate
fields:

  - Image
  - TargetFilename
  - User
falsepositives:

  - Legitimate PHP file deployment by Joomla extension installers (verify against change management records)
level: high

title: Unexpected Joomla Super User Account Creation
id: 9c5e3b4a-2026-4890-abcd-001122334455
status: experimental
description: Detects creation of new Super User accounts in Joomla, consistent with CVE-2026-48908 post-exploitation
author: Adverse Trace
date: 2026/07/08
references:

  - https://thehackernews.com/2026/07/cisa-adds-4-actively-exploited-adobe.html
logsource:
  product: joomla
  category: user_management
detection:
  selection:
    event_type: user_create
    user_group: Super Users
  condition: selection
fields:

  - src_ip
  - user_name
  - user_email
  - event_time
falsepositives:

  - Legitimate Super User provisioning (verify against IAM change records)
level: high

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• The Hacker News — "CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV" — https://thehackernews.com/2026/07/cisa-adds-4-actively-exploited-adobe.html — 2026-07-08
• SecurityWeek — "Critical Adobe ColdFusion Vulnerability Exploited in Attacks" — https://www.securityweek.com/critical-adobe-coldfusion-vulnerability-exploited-in-attacks/ — 2026-07
• Help Net Security — "Attackers exploit critical Adobe ColdFusion vulnerability (CVE-2026-48282)" — https://www.helpnetsecurity.com/2026/07/07/adobe-coldfusion-cve-2026-48282-exploitation-detected/ — 2026-07-07
• BSI Germany — "[NEU] [hoch] Adobe ColdFusion: Mehrere Schwachstellen" — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1858 — 2026-07

8. Adverse Trace position

CVE-2026-48282 is the highest-priority item in this KEV addition for EMEA financial services: CVSS 10.0, actively exploited within hours of technical disclosure, and Adobe ColdFusion is widely deployed in enterprise environments. The speed of weaponisation (minutes after watchTowr's publication) demonstrates that threat actors are monitoring security research outputs and automating exploitation against exposed targets. The Joomla vulnerabilities (CVE-2026-56290 and CVE-2026-48908) are lower probability for core banking infrastructure but are directly relevant to customer-facing portals, marketing sites, and CMS-driven microsites that financial institutions frequently operate. The Langflow IDOR (CVE-2026-55255) is niche but significant for institutions running AI/ML platforms — the credential theft angle (LLM provider keys, AWS keys) creates downstream cloud account compromise risk. All four vulnerabilities have available patches; the operational priority is asset discovery and patch verification. We are updating client threat profiles to include these CVEs and will provide follow-up if additional exploitation details or attribution data emerge. The IPs 103.207.14[.]220 and 45.207.216[.]55 are single-sourced and should be verified before enforcement action.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.