U.S. CISA adds Adobe ColdFusion, Joomlack Page Builder, Langflow, and JoomShaper SP Page Builder flaws to its Known Exploited Vulnerabilities catalog

CVE-2026-33017 is an unauthenticated remote code execution flaw in Langflow, an open-source tool for building and deploying AI-powered agents and workflows. The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which by design requires no authentication for building public flows, accepts an optional data parameter; when present, attacker-controlled flow data — including arbitrary Python code embedded in node definitions — is used instead of the flow stored in the database and passed to exec() with no sandboxing. An attacker who can reach this endpoint on an affected instance can therefore execute arbitrary Python code without any credentials, typically yielding full compromise of the underlying server. All Langflow versions prior to 1.9.0 are affected; the issue was fixed in 1.9.0 and is distinct from CVE-2025-3248, which only added authentication to the /api/v1/validate/code endpoint. The flaw was added to CISA's KEV catalog on 2026-03-25 (confirming exploitation in the wild), carries a 96.2% EPSS probability of exploitation within 30 days, and related reporting describes Langflow RCE attacks, including ransomware activity targeting AI model files.

Do: Upgrade all Langflow deployments to 1.9.0 or later. If immediate patching is not possible, keep Langflow off direct internet exposure (place it behind an authenticating reverse proxy or firewall) and review logs for unauthenticated POST requests to /api/v1/build_public_tmp/{flow_id}/flow that include a data parameter, which would indicate exploitation attempts. As a KEV entry, federal agencies must apply mitigations per vendor guidance and BOD 22-01, or discontinue use of the product if mitigations are unavailable.

CVE-2026-48282 is a path traversal vulnerability (CWE-22) in Adobe ColdFusion. It is triggered by crafted file-path input containing directory-traversal sequences that the application fails to constrain, allowing access outside the intended directory; per CISA this can escalate to arbitrary code execution in the context of the current user. Successful exploitation could give an attacker the ability to run code on the ColdFusion host under the ColdFusion service account, a common foothold for further network compromise. All organizations running affected Adobe ColdFusion releases, particularly internet-facing instances, are in scope; the specific affected version ranges have not been detailed in the available data. The flaw is already being exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-07 and carries a 42.4% EPSS probability of exploitation within 30 days (99th percentile), though no public PoC is known and ransomware use is unconfirmed.

Do: Inventory all Adobe ColdFusion deployments, prioritizing internet-facing servers, and apply the vendor patch per Adobe's security advisory since the affected version ranges are not yet specified in this data. Federal agencies must patch or apply mitigations in accordance with CISA BOD 26-04 within the KEV deadline or discontinue use if mitigations are unavailable. Until patched, restrict external access to ColdFusion instances and consider WAF/IPS rules blocking directory-traversal sequences in file-path parameters.

CVE-2026-48908 is an unrestricted upload of files with dangerous types (CWE-434) in the SP Page Builder extension for Joomla developed by JoomShaper/Ollyo. An unauthenticated remote attacker can submit arbitrary files, including PHP files, to the vulnerable upload functionality, and the web server subsequently executes the uploaded PHP. Successful exploitation therefore results in full remote code execution on the hosting server with the privileges of the web service, giving the attacker control over the Joomla site and its data (CVSS 4.0 base score: 10.0, critical). Any Joomla site running SP Page Builder is affected; the available data does not specify affected or fixed version ranges. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-07, and EPSS assigns a 14.8% probability of exploitation within 30 days (96th percentile); no public proof-of-concept is known.

Do: Upgrade SP Page Builder to the latest release published by Ollyo/JoomShaper and follow the vendor advisory (no specific fixed version is provided in this data); federal agencies must apply mitigations per CISA's BOD 26-04 timelines and the KEV required action. Until patched, restrict or firewall unauthenticated access to SP Page Builder upload endpoints and review web-access logs and upload directories for recently dropped PHP files or webshells, since the flaw is confirmed exploited in the wild.

Langflow, an open-source platform for building and deploying AI-powered agents and workflows, contains an authorization bypass (Insecure Direct Object Reference, CWE-639) in its /api/v1/responses endpoint in all versions prior to 1.9.1. An authenticated low-privileged user triggers the flaw by supplying another user's flow ID in the request, causing Langflow to execute that flow without verifying ownership. Because the attacker can run flows belonging to other users on a shared or multi-tenant instance, they can leverage those flows' configured credentials and integrations; public reporting indicates attackers are using the flaw for credential harvesting, which aligns with the flaw's high confidentiality and integrity impact (CVSS 3.1 score 8.4, with scope change). All Langflow deployments running anything earlier than 1.9.1 are affected, with multi-user or shared instances at greatest risk. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-07-07, confirming exploitation in the wild; ransomware use is currently unknown.

Do: Upgrade Langflow to 1.9.1 or later immediately, prioritizing internet-facing and multi-user instances, in line with CISA KEV and BOD 26-04 deadlines. If patching must wait, restrict access to /api/v1/responses to trusted users and review logs for requests specifying other users' flow IDs, which may indicate credential harvesting. Per BOD 26-04, evaluate each asset's internet exposure, follow the vendor advisory (GHSA-qrpv-q767-xqq2) for mitigations, and discontinue use where mitigations are unavailable.

Joomlack Page Builder, a page-builder extension for the Joomla CMS from the Joomlack vendor, contains an improper access control flaw (CWE-284) that permits unauthenticated arbitrary file upload to affected sites. An unauthenticated remote attacker can abuse the upload functionality to place attacker-controlled files, typically executable script files, on the web server and then request them to achieve remote code execution. Successful exploitation yields code execution under the web server's privileges, enabling full compromise of the website and potentially the underlying hosting account or server; ransomware use has not been confirmed. Any Joomla deployment with the affected extension installed is potentially exposed, with internet-facing sites at greatest risk, and CISA has not published specific affected version ranges. The flaw was added to the CISA KEV catalog on 2026-07-07, indicating confirmed in-the-wild exploitation, and it carries a high exploitation likelihood (EPSS 30.4%, 98th percentile), although no public proof-of-concept or detailed technical write-up is known.

Do: Inventory Joomla sites for the Joomlack Page Builder extension and apply the vendor's fix as soon as it is released, following the CISA required action and BOD 26-04 guidance; if mitigations are unavailable, remove, disable, or restrict the extension - particularly on internet-exposed or cloud-hosted instances - or discontinue use per BOD 26-04. Until patched, review upload directories for unexpected executable files (e.g., potential webshells) and check access logs for unauthenticated upload requests, and limit direct web access to upload paths where feasible.