Executive Summary
CISA has expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding several critical vulnerabilities affecting enterprise web applications and AI platforms. These vulnerabilities are confirmed to be exploited in the wild, making them high-priority remediation targets for both public and private sector organizations.
The latest additions include vulnerabilities affecting:
- Adobe ColdFusion
- Langflow
- JoomShaper SP Page Builder
- Joomlack Page Builder CK
These products are frequently internet-facing and, if compromised, can provide attackers with initial access, remote code execution (RCE), or full administrative control.
Why the KEV Catalog Matters
Many organizations still prioritize vulnerabilities solely by CVSS.
That approach is incomplete.
The KEV Catalog represents vulnerabilities that have crossed an important threshold:
They are actively being exploited by real-world attackers.
This makes KEV entries significantly more important than vulnerabilities that are merely “critical.”
Organizations with mature vulnerability management programs should automatically elevate KEV vulnerabilities to emergency remediation status.
Newly Added Vulnerabilities
1. Adobe ColdFusion
CVE: CVE-2026-48282
Impact
A critical path traversal vulnerability that can ultimately lead to remote code execution.
ColdFusion continues to remain an attractive target because:
- Internet-facing deployments are common.
- Legacy servers frequently remain unpatched.
- Successful exploitation often provides complete server compromise.
Potential Attacker Objectives
- Upload web shells
- Execute arbitrary commands
- Deploy ransomware
- Establish persistence
- Steal application secrets
2. Langflow
CVE: CVE-2026-55255
Impact
A critical Insecure Direct Object Reference (IDOR) vulnerability affecting Langflow deployments.
Langflow has rapidly gained adoption for building Generative AI workflows.
Because these platforms often connect to:
- LLM providers
- Internal APIs
- Databases
- Secrets managers
- AI agents
Compromising Langflow may expose significantly more than the application itself.
Security Concerns
An attacker could potentially:
- Access workflows
- Modify AI pipelines
- Extract API keys
- Pivot into connected environments
- Abuse AI infrastructure
3. JoomShaper SP Page Builder
CVE: CVE-2026-48908
Impact
An unauthenticated arbitrary file upload vulnerability leading to Remote Code Execution.
Successful exploitation allows attackers to upload malicious PHP files and execute them on the server.
Typical Outcomes
- Website takeover
- Web shell deployment
- Malware hosting
- Credential theft
- Lateral movement
4. Joomlack Page Builder CK
CVE: CVE-2026-56290
Impact
Another unauthenticated file upload vulnerability capable of resulting in full server compromise.
CMS plugins continue to be attractive targets because they are frequently:
- Publicly exposed
- Poorly monitored
- Updated infrequently
Common Attack Pattern
Despite affecting different products, these vulnerabilities follow a familiar attack lifecycle:Internet Exposure │ ▼ Initial Exploitation │ ▼ Remote Code Execution │ ▼ Web Shell Installation │ ▼ Privilege Escalation │ ▼ Credential Theft │ ▼ Lateral Movement │ ▼ Data Exfiltration or Ransomware
Organizations should recognize that RCE is often the beginning—not the end—of an attack.
Governance Perspective
These KEV additions highlight several governance challenges:
Asset Visibility
Many organizations cannot accurately identify:
- ColdFusion servers
- Joomla plugins
- AI platforms like Langflow
Unknown assets cannot be patched.
Third-Party Component Governance
CMS plugins and AI frameworks often bypass traditional governance processes.
Security teams should ensure:
- Software inventories remain current.
- Unsupported components are retired.
- Plugin approval processes exist.
AI Governance
Langflow illustrates a growing governance challenge.
AI orchestration platforms frequently contain:
- API tokens
- Model credentials
- Database connections
- Business logic
- Sensitive prompts
These environments require the same security oversight as production applications.
Risk-Based Vulnerability Management
Effective vulnerability management requires more than CVSS.
Prioritize vulnerabilities using multiple factors:
- KEV status
- Internet exposure
- Business criticality
- Exploit availability
- Threat intelligence
- Asset sensitivity
Detection Recommendations
Security Operations Centers should monitor for:
- Unexpected file uploads
- Newly created PHP or JSP files
- Suspicious PowerShell or shell execution
- Web shell indicators
- Outbound command-and-control traffic
- Privilege escalation events
- Unusual administrative logins
Historical logs should also be reviewed to determine whether exploitation occurred before patching.
Immediate Mitigation Actions
Organizations should:
- Inventory all ColdFusion, Langflow, and Joomla deployments.
- Identify installations using affected JoomShaper or Joomlack components.
- Apply vendor patches or mitigations immediately.
- Remove unsupported or unused installations.
- Hunt for indicators of compromise.
- Rotate credentials if compromise is suspected.
- Validate web application integrity.
- Increase monitoring of internet-facing servers.
- Ensure KEV vulnerabilities receive expedited remediation through established change management processes.
Strategic Lessons
These KEV additions reinforce several broader cybersecurity lessons:
- Active exploitation should drive remediation priorities.
- AI platforms are now part of the enterprise attack surface.
- CMS plugins remain a persistent source of compromise.
- Asset inventory is foundational to vulnerability management.
- Governance is essential to ensure rapid, risk-based patching.
Security leaders should treat every new KEV addition as a signal to reassess exposure, validate asset visibility, and confirm that vulnerability management processes can respond with the urgency that active exploitation demands.
Final Thoughts
The addition of Adobe ColdFusion, Langflow, JoomShaper SP Page Builder, and Joomlack Page Builder CK to the CISA KEV Catalog is more than a routine catalog update. It reflects active attacker interest in technologies spanning traditional web applications, content management systems, and modern AI platforms.
For defenders, the priority is clear: identify affected assets, patch without delay, investigate for signs of compromise, and ensure governance processes consistently elevate KEV-listed vulnerabilities to the highest remediation priority.
