# CISA Warns of Four Critical Vulnerabilities Under Active Exploitation—Including AI Platform Credential Theft
## The Threat
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog on July 8, 2026, after confirming widespread active exploitation of each. The vulnerabilities span enterprise software and open-source platforms, ranging from enterprise application servers to popular website builder plugins, with attack evidence already documented in the wild.
What makes this advisory particularly urgent is the breadth of exposure and attack sophistication. Three of the four flaws carry a maximum CVSS severity score of 10.0, indicating complete system compromise is possible with minimal user interaction. More critically, attackers are combining multiple vulnerabilities in coordinated campaigns—particularly against Langflow, an AI orchestration platform where threat actors have successfully harvested Large Language Model (LLM) provider API keys and AWS credentials. This represents an emerging attack vector: compromising the infrastructure that manages generative AI workflows to steal the credentials that govern access to expensive AI services and cloud infrastructure.
The exploitation timeline is alarming. Adobe ColdFusion's path traversal flaw (CVE-2026-48282) was exploited within hours of public disclosure, with researchers confirming attack attempts originating from India. JoomShaper's SP Page Builder vulnerability (CVE-2026-48908) circulated as a zero-day before patches were available, with attackers creating new administrator accounts on compromised sites. Joomla and WordPress administrators have documented exploitation attempts for CVE-2026-56290 since late June. These are not theoretical vulnerabilities—they are actively weaponized tools in attackers' arsenals.
## Severity and Impact
| CVE ID | Product | CVSS Score | Vector | Attack Complexity | Authentication | Impact |
|--------|---------|------------|--------|-------------------|-----------------|--------|
| CVE-2026-48282 | Adobe ColdFusion | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Low | None | Arbitrary code execution as current user |
| CVE-2026-56290 | Joomla Page Builder | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Low | None | Unauthenticated remote code execution via file upload |
| CVE-2026-48908 | JoomShaper SP Page Builder | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Low | None | Unauthenticated arbitrary file upload and PHP execution |
| CVE-2026-55255 | Langflow | 6.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N | Low | Required | Cross-tenant IDOR: credential theft and flow manipulation |
All four flaws enable unauthenticated or low-friction remote code execution, allowing attackers to establish persistent access, deploy malware, or extract sensitive data from affected systems. The convergence of these vulnerabilities in active campaigns indicates coordinated targeting of high-value assets.
## Affected Products
Adobe Products:
Joomla Extensions:
JoomShaper Products:
AI/LLM Platforms:
## Mitigations
Immediate Actions:
1. Apply patches immediately. SP Page Builder users must update to version 6.6.2 or later. PageBuilder CK deployments should upgrade to version 3.6.0 or later. For Adobe ColdFusion and Langflow, consult vendor security advisories for the latest patch versions.
2. Scan for web shells and unauthorized accounts. Organizations running affected page builders should search for suspicious PHP files in /media/com_pagebuilderck/, /images/, /media/, /templates/, and /administrator/ directories. Check user accounts for unauthorized Super User or administrator accounts created during the attack window.
3. Secure Langflow deployments. Immediately restrict network access to Langflow instances to authenticated users only. Do not expose Langflow to the internet without authentication. Rotate all LLM provider API keys and AWS credentials stored in or accessible from Langflow instances, as CVE-2026-55255 exploitation has been confirmed to extract these secrets.
4. Monitor for exploitation indicators. Review web server access logs for requests to suspicious endpoints, particularly:
- Adobe ColdFusion path traversal patterns
- HTTP POST requests to index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon
- Large file uploads to Page Builder plugin directories
- Requests to Langflow /api/flows/ endpoints from unexpected sources
Longer-term Hardening:
## References
---
## HackWire Analysis
This advisory illuminates two converging threat trends that deserve closer attention from defenders and security teams. First, the rapid weaponization of website builder plugins reflects a deliberate shift in attacker strategy: rather than targeting monolithic platforms like WordPress core, threat actors now hunt for vulnerabilities in the ecosystem of page builders and plugin extensions that millions of sites depend on. These extensions are often updated less frequently than their parent platforms, and the consequences of compromise are identical—complete site takeover, malware distribution, or credential theft. The presence of two separate Joomla page builder vulnerabilities in this advisory suggests these platforms are becoming systematized reconnaissance targets.
Second, and more alarming, is the emergence of AI orchestration platforms as credential stores under active assault. Langflow is not unique; any system that integrates with LLM APIs or cloud infrastructure necessarily stores API keys, AWS credentials, or authentication tokens. The CVE-2026-55255 IDOR exploit, combined with the separate RCE flaw, created a perfect storm for attackers seeking to harvest expensive credentials—LLM provider access costs real money, and stolen AWS keys unlock further intrusions. The operator's methodical reconnaissance, enumeration, and multi-stage exploitation chain (IDOR for credentials, RCE for persistence) indicates this is not script-kiddie activity; this is deliberate, financially motivated targeting of AI infrastructure. As organizations rush to integrate AI into their operations, they are inadvertently concentrating high-value secrets in new, less-hardened platforms.
The speed of exploitation—hours after disclosure for Adobe, pre-patch exploitation for JoomShaper—also signals that vulnerability disclosure timing has collapsed. Organizations can no longer assume a grace period between CVE publication and weaponization. The practical implication is stark: patch deployment must move from a quarterly or monthly cycle to an emergency response capability for critical flaws. — HackWire Editorial
## Related Coverage