CISA Adds Four Actively Exploited Vulnerabilities to Known Exploited Vulnerabilities Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities include a path traversal flaw in Adobe ColdFusion (CVE-2026-48282), improper access control in Joomlack Page Builder (CVE-2026-56290), an authorization bypass in Langflow (CVE-2026-55255), and an unrestricted file upload in JoomShaper SP Page Builder (CVE-2026-48908).

Context

CISA's Known Exploited Vulnerabilities catalog serves as a resource for organizations to identify and prioritize security risks. The four vulnerabilities added are actively being exploited, indicating a clear and present danger to users of the respective software. This action reflects the agency's commitment to improving national cybersecurity by informing the public about significant threats.

Why it matters

The addition of these vulnerabilities to CISA's catalog highlights the ongoing threat posed by cyberattacks. Organizations using affected software are at heightened risk of exploitation, which can lead to data breaches and operational disruptions. Awareness of these vulnerabilities is crucial for cybersecurity preparedness and response efforts.

Implications

Businesses and individuals using the impacted software may face increased risk of cyberattacks if they do not take immediate action. Failure to address these vulnerabilities could result in significant financial losses, reputational damage, and legal consequences. The announcement underscores the importance of proactive cybersecurity measures in protecting sensitive information.

What to watch

Organizations using the affected software should prioritize patching these vulnerabilities to mitigate risks. CISA may provide further guidance or updates on remediation efforts in the coming weeks. Monitoring cyber threat intelligence sources will be essential for understanding the evolving landscape of these vulnerabilities.