CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV

Langflow, an open-source visual framework for building LLM and agentic AI applications, contains a missing authentication flaw (CWE-306) in its /api/v1/validate/code endpoint. A remote attacker with network reachability to the endpoint can send crafted HTTP requests without any credentials, causing arbitrary code execution on the server. Successful exploitation yields code execution under the application's privileges, enabling data theft, backdoor installation, and, per CISA, ransomware deployment. Any running Langflow instance is affected; the tool is typically self-hosted by development teams building AI workflows, so real-world exposure depends on whether each instance is reachable from untrusted networks. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2025-05-05 with known ransomware use, EPSS assigns a 100% probability of exploitation within 30 days (100th percentile), and a public PoC is available.

Do: Upgrade Langflow to the latest patched release identified in the vendor's advisory; federal agencies must apply mitigations per vendor instructions under BOD 22-01 or discontinue use if mitigations are unavailable. Until patched, restrict network access to the /api/v1/validate/code endpoint via reverse-proxy authentication, firewall rules, or VPN placement, and avoid exposing Langflow directly to the internet. Because ransomware use is confirmed, review access and process-execution logs for signs of prior compromise.

Langflow versions up to and including 1.6.9 chain two web-security weaknesses - a permissive CORS configuration (allow_origins='*' with allow_credentials=True) and a refresh-token cookie set with SameSite=None - into account takeover and remote code execution. When an authenticated Langflow user visits an attacker-controlled webpage, the browser silently sends credentialed cross-origin requests that successfully call the refresh endpoint, letting the attacker mint fresh access_token/refresh_token pairs for the victim's session (CWE-346). With those tokens, the attacker can access authenticated endpoints, including Langflow's built-in code-execution functionality, and run arbitrary code for full system compromise. Any Langflow deployment at or below version 1.6.9 is affected, with internet-facing instances most exposed. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-21, and EPSS assigns an 83.6% probability of exploitation within 30 days (100th percentile).

Do: Upgrade Langflow to a release newer than 1.6.9 following vendor guidance, and invalidate existing sessions afterward. If patching must wait, correct the CORS configuration (do not combine allow_origins='*' with allow_credentials=True), stop marking the refresh-token cookie SameSite=None, and restrict internet exposure of the instance. Review access logs for refresh-endpoint calls from unexpected origins, rotate tokens and credentials for suspected victims, and follow BOD 22-01 requirements if you are a U.S. federal agency.

CVE-2026-0770 is an unauthenticated remote code execution vulnerability in Langflow, an open-source visual builder for LLM and AI agent workflows. The flaw, categorized as CWE-829 (inclusion of functionality from an untrusted control sphere), resides in how the exec_globals parameter supplied to the validate endpoint is handled, allowing code or resources from an untrusted control sphere to be included and executed. A remote attacker with no credentials can send a crafted request to that endpoint and execute arbitrary code in the context of root on the affected installation. Any deployment of an affected Langflow version is exposed, with internet-facing self-hosted or containerized instances at greatest risk. The issue was disclosed through Trend Micro's Zero Day Initiative (ZDI-CAN-27325) and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-21, confirming active in-the-wild exploitation; no public proof-of-concept is known.

Do: Apply the vendor's patched Langflow release and any prescribed mitigations per CISA guidance; because exploitation requires no authentication and executes as root, prioritize internet-exposed instances immediately (EPSS is high at 63.4%). Per BOD 26-04, if mitigations or updates are unavailable for a given deployment, discontinue use of the product. Review access logs for unexpected unauthenticated requests to the validate endpoint containing crafted exec_globals parameters, and restrict network exposure of Langflow instances until patched.

Multiple critical API endpoints in Langflow, an open-source tool for building and deploying AI-powered agents and workflows, lack required authentication (CWE-306), so any unauthenticated user can reach them directly over the network with no privileges or user interaction required. By sending crafted requests to these endpoints, an attacker can read sensitive user conversation data and transaction histories and can perform destructive operations such as deleting messages. Any organization or individual running an affected Langflow deployment whose API is reachable, especially instances exposed to the internet, is affected, since the endpoints handle personal data and system operations that should require proper authorization. A public proof of concept is available via the project's GitHub security advisory (GHSA-c5cp-vx83-jhqx), EPSS assigns a 33.7% probability of exploitation within 30 days (98th percentile), and recent reporting indicates CISA has added actively exploited Langflow flaws to its KEV catalog, so this should be treated as exploited in the wild. Version 1.7.0.dev45 contains the patch.

Do: Upgrade Langflow to version 1.7.0.dev45 or later. If you cannot upgrade immediately, restrict access to the affected API endpoints to trusted networks or place them behind an authenticating reverse proxy or API gateway. Review logs for unauthenticated requests to conversation, transaction, and message endpoints, and check for unexpected message deletions or access to user conversation data.

CVE-2026-33017 is an unauthenticated remote code execution flaw in Langflow, an open-source tool for building and deploying AI-powered agents and workflows. The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which by design requires no authentication for building public flows, accepts an optional data parameter; when present, attacker-controlled flow data — including arbitrary Python code embedded in node definitions — is used instead of the flow stored in the database and passed to exec() with no sandboxing. An attacker who can reach this endpoint on an affected instance can therefore execute arbitrary Python code without any credentials, typically yielding full compromise of the underlying server. All Langflow versions prior to 1.9.0 are affected; the issue was fixed in 1.9.0 and is distinct from CVE-2025-3248, which only added authentication to the /api/v1/validate/code endpoint. The flaw was added to CISA's KEV catalog on 2026-03-25 (confirming exploitation in the wild), carries a 96.2% EPSS probability of exploitation within 30 days, and related reporting describes Langflow RCE attacks, including ransomware activity targeting AI model files.

Do: Upgrade all Langflow deployments to 1.9.0 or later. If immediate patching is not possible, keep Langflow off direct internet exposure (place it behind an authenticating reverse proxy or firewall) and review logs for unauthenticated POST requests to /api/v1/build_public_tmp/{flow_id}/flow that include a data parameter, which would indicate exploitation attempts. As a KEV entry, federal agencies must apply mitigations per vendor guidance and BOD 22-01, or discontinue use of the product if mitigations are unavailable.

CVE-2026-48282 is a path traversal vulnerability (CWE-22) in Adobe ColdFusion. It is triggered by crafted file-path input containing directory-traversal sequences that the application fails to constrain, allowing access outside the intended directory; per CISA this can escalate to arbitrary code execution in the context of the current user. Successful exploitation could give an attacker the ability to run code on the ColdFusion host under the ColdFusion service account, a common foothold for further network compromise. All organizations running affected Adobe ColdFusion releases, particularly internet-facing instances, are in scope; the specific affected version ranges have not been detailed in the available data. The flaw is already being exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-07 and carries a 42.4% EPSS probability of exploitation within 30 days (99th percentile), though no public PoC is known and ransomware use is unconfirmed.

Do: Inventory all Adobe ColdFusion deployments, prioritizing internet-facing servers, and apply the vendor patch per Adobe's security advisory since the affected version ranges are not yet specified in this data. Federal agencies must patch or apply mitigations in accordance with CISA BOD 26-04 within the KEV deadline or discontinue use if mitigations are unavailable. Until patched, restrict external access to ColdFusion instances and consider WAF/IPS rules blocking directory-traversal sequences in file-path parameters.

CVE-2026-48908 is an unrestricted upload of files with dangerous types (CWE-434) in the SP Page Builder extension for Joomla developed by JoomShaper/Ollyo. An unauthenticated remote attacker can submit arbitrary files, including PHP files, to the vulnerable upload functionality, and the web server subsequently executes the uploaded PHP. Successful exploitation therefore results in full remote code execution on the hosting server with the privileges of the web service, giving the attacker control over the Joomla site and its data (CVSS 4.0 base score: 10.0, critical). Any Joomla site running SP Page Builder is affected; the available data does not specify affected or fixed version ranges. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-07, and EPSS assigns a 14.8% probability of exploitation within 30 days (96th percentile); no public proof-of-concept is known.

Do: Upgrade SP Page Builder to the latest release published by Ollyo/JoomShaper and follow the vendor advisory (no specific fixed version is provided in this data); federal agencies must apply mitigations per CISA's BOD 26-04 timelines and the KEV required action. Until patched, restrict or firewall unauthenticated access to SP Page Builder upload endpoints and review web-access logs and upload directories for recently dropped PHP files or webshells, since the flaw is confirmed exploited in the wild.

CVE-2026-5027 is a path traversal flaw (CWE-22) in the 'POST /api/v2/files' endpoint of Langflow, the open-source platform for building AI/LLM agent workflows. The endpoint fails to sanitize the 'filename' field supplied in multipart form data, so an attacker who submits a name containing '../' sequences can direct the resulting file write to arbitrary locations on the server's filesystem. The CVSS vector (network-accessible, low complexity, low-privilege account required, no user interaction) indicates an authenticated user can abuse this to overwrite or create files at attacker-chosen paths, which can compromise confidentiality, integrity, and availability — for example by overwriting configuration, credentials, or executable content that leads to code execution depending on deployment. Any organization running a self-hosted Langflow instance that exposes the files API, even to low-privileged accounts, is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known for this specific CVE, and it is not yet on CISA's KEV list, but its elevated EPSS (36.1%, 98th percentile) and active exploitation of other Langflow vulnerabilities (e.g., CVE-2026-0768) suggest near-term exploitation risk.

Do: Upgrade Langflow to the latest patched release per the vendor advisory (specific fixed version is not stated in the available data). Until patched, restrict access to /api/v2/files to trusted, authenticated users, place Langflow behind authentication/reverse-proxy filtering that strips or validates '..' sequences in multipart filenames, and avoid exposing the instance directly to the internet. Review access logs for multipart POST requests to /api/v2/files with filenames containing '../' that could indicate attempted traversal writes.

Langflow, an open-source platform for building and deploying AI-powered agents and workflows, contains an authorization bypass (Insecure Direct Object Reference, CWE-639) in its /api/v1/responses endpoint in all versions prior to 1.9.1. An authenticated low-privileged user triggers the flaw by supplying another user's flow ID in the request, causing Langflow to execute that flow without verifying ownership. Because the attacker can run flows belonging to other users on a shared or multi-tenant instance, they can leverage those flows' configured credentials and integrations; public reporting indicates attackers are using the flaw for credential harvesting, which aligns with the flaw's high confidentiality and integrity impact (CVSS 3.1 score 8.4, with scope change). All Langflow deployments running anything earlier than 1.9.1 are affected, with multi-user or shared instances at greatest risk. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-07-07, confirming exploitation in the wild; ransomware use is currently unknown.

Do: Upgrade Langflow to 1.9.1 or later immediately, prioritizing internet-facing and multi-user instances, in line with CISA KEV and BOD 26-04 deadlines. If patching must wait, restrict access to /api/v1/responses to trusted users and review logs for requests specifying other users' flow IDs, which may indicate credential harvesting. Per BOD 26-04, evaluate each asset's internet exposure, follow the vendor advisory (GHSA-qrpv-q767-xqq2) for mitigations, and discontinue use where mitigations are unavailable.

Joomlack Page Builder, a page-builder extension for the Joomla CMS from the Joomlack vendor, contains an improper access control flaw (CWE-284) that permits unauthenticated arbitrary file upload to affected sites. An unauthenticated remote attacker can abuse the upload functionality to place attacker-controlled files, typically executable script files, on the web server and then request them to achieve remote code execution. Successful exploitation yields code execution under the web server's privileges, enabling full compromise of the website and potentially the underlying hosting account or server; ransomware use has not been confirmed. Any Joomla deployment with the affected extension installed is potentially exposed, with internet-facing sites at greatest risk, and CISA has not published specific affected version ranges. The flaw was added to the CISA KEV catalog on 2026-07-07, indicating confirmed in-the-wild exploitation, and it carries a high exploitation likelihood (EPSS 30.4%, 98th percentile), although no public proof-of-concept or detailed technical write-up is known.

Do: Inventory Joomla sites for the Joomlack Page Builder extension and apply the vendor's fix as soon as it is released, following the CISA required action and BOD 26-04 guidance; if mitigations are unavailable, remove, disable, or restrict the extension - particularly on internet-exposed or cloud-hosted instances - or discontinue use per BOD 26-04. Until patched, review upload directories for unexpected executable files (e.g., potential webshells) and check access logs for unauthenticated upload requests, and limit direct web access to upload paths where feasible.