On July 7, 2026, the U.S. CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. Three carry the maximum CVSS score of 10.0, affecting Adobe ColdFusion, Joomla page builders, and the AI-agent building tool Langflow. Federal agencies were ordered to apply fixes by July 10.
July 2026 · CISA Known Exploited Vulnerabilities
Four Actively Exploited Flaws Flagged — AI Tooling Joins the Target List
CISA added critical bugs in Adobe ColdFusion, two Joomla page builders, and the AI workflow tool Langflow to its KEV catalog. Three score a maximum CVSS 10.0. Federal agencies were ordered to patch by July 10, 2026.
4
vulnerabilities added under active exploitation
10.0
maximum CVSS on three of the four flaws
145k+
GitHub stars on Langflow, the AI tool now targeted
The four added entries
Adobe ColdFusion · CVE-2026-48282
Path traversal leading to remote code execution
10.0
Joomlack Page Builder CK · CVE-2026-56290
Unauthenticated file upload leading to RCE
10.0
JoomShaper SP Page Builder · CVE-2026-48908
Unrestricted file upload leading to RCE
10.0
Langflow (AI workflows) · CVE-2026-55255
IDOR — running another user's flow across tenants
6.1
The chained attack on AI tooling
Alone, the Langflow IDOR scores just 6.1 — but paired with an existing RCE it escalates from a foothold to a full cloud compromise.
RCE on host
compromise the instance
→
IDOR seizes flows
access other users' data
→
Credential theft
LLM API + AWS keys
Speed of weaponization
ColdFusion exploitation was seen within hours of the patch; past Langflow flaws were weaponized within 20 hours of disclosure. Defenders have almost no window.
~ hours
ColdFusion exploited after patch
~ 20 hrs
Langflow weaponized after disclosure
Do now
Patch: ColdFusion (APSB26-68), Page Builder CK 3.6.0, SP Page Builder 6.6.2, Langflow 1.9.1
Hunt for suspicious PHP under /media, /images, /templates
Isolate credentials; limit exposure of self-hosted instances
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article…