CISA Adds Four Actively Exploited Vulnerabilities, Including Adobe ColdFusion Flaw, to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Among these is CVE-2026-48282, a critical path traversal vulnerability in Adobe ColdFusion that could lead to arbitrary code execution. Other flaws include improper access control in Joomlack Page Builder (CVE-2026-56290), an authorization bypass in Langflow (CVE-2026-55255), and an unrestricted file upload in JoomShaper SP Page Builder (CVE-2026-48908). Federal agencies are urged to remediate these vulnerabilities by July 10, 2026.

Context

CISA's KEV catalog serves as a resource for identifying vulnerabilities that are actively being exploited in the wild. The vulnerabilities added include a critical flaw in Adobe ColdFusion, which is widely used in web applications, as well as issues in popular page builders. Addressing these vulnerabilities is crucial for organizations to safeguard their systems against potential attacks.

Why it matters

The addition of these vulnerabilities to the KEV catalog highlights the ongoing risks posed by cyber threats to critical infrastructure. Active exploitation of these flaws can lead to significant security breaches, affecting both public and private sectors. Timely remediation is essential to protect sensitive data and maintain operational integrity.

Implications

Failure to address these vulnerabilities could result in severe consequences, including data breaches and operational disruptions. Organizations using the affected software may face increased scrutiny from regulators and stakeholders. The broader cybersecurity ecosystem may also experience heightened threat levels as attackers exploit these weaknesses.

What to watch

Organizations should prioritize patching the identified vulnerabilities before the July 10, 2026 deadline set by CISA. Monitoring for any reported incidents related to these flaws will be important for understanding the threat landscape. Additionally, updates from CISA and other cybersecurity agencies may provide further guidance on mitigation strategies.