# Critical Authentication Bypass and RCE Flaws in ColdFusion, Langflow, and Joomla Extensions Under Active Attack


The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild across Adobe ColdFusion, Langflow, and popular Joomla page builder extensions. All four flaws carry perfect or near-perfect severity scores and require no authentication or user interaction to exploit. Federal agencies must patch by July 10 under mandatory directive BOD 26-04.


## The Threat


The four vulnerabilities represent a cascade of critical weaknesses being weaponized in coordinated attacks. Adobe ColdFusion's path traversal vulnerability (CVE-2026-48282) was patched on June 30, yet threat actors began exploiting it within days—demonstrating how rapid the window between patch release and active abuse has become. The flaw allows unauthenticated attackers to traverse the file system and execute arbitrary code, giving adversaries direct access to application servers running the platform.


Langflow, an open-source platform for building AI agent workflows, suffers from a cross-tenant insecure direct object reference (IDOR) flaw (CVE-2026-55255) that permits attackers to execute workflows belonging to other users by simply manipulating a flow UUID. Security researchers at Sysdig first documented active exploitation on June 26—before any public proof-of-concept existed—revealing a sophisticated threat actor conducting host reconnaissance, harvesting flow IDs, and chaining the IDOR vulnerability with a prior Langflow RCE bug (CVE-2026-33017) for full system compromise.


The Joomla extension vulnerabilities are equally severe. Both SP Page Builder and Page Builder CK allow unauthenticated arbitrary file uploads leading to remote code execution. Real-world attacks have already observed threat actors using these flaws to plant hidden administrator accounts and deploy persistent PHP file manager backdoors, establishing long-term footholds on compromised websites. The Page Builder CK vulnerability was exploited within hours of its patch release on June 27, underscoring the speed at which adversaries move.


## Severity and Impact


| CVE | Component | CVSS Score | Vector String | Attack Complexity | Authentication Required | Patch Released |

|-----|-----------|------------|----------------|--------------------|------------------------|-----------------|

| CVE-2026-48282 | Adobe ColdFusion | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Low | None | June 30, 2026 |

| CVE-2026-55255 | Langflow | 9.9 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Low | None | Before June 26 |

| CVE-2026-48908 | SP Page Builder (Joomla) | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Low | None | Version 6.6.2 |

| CVE-2026-56290 | Page Builder CK (Joomla) | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Low | None | June 27, 2026 |


All four vulnerabilities allow unauthenticated remote code execution with no user interaction required. Attack complexity is minimal; no special conditions or permissions are needed. Successful exploitation grants complete control over affected systems.


## Affected Products


Adobe ColdFusion

  • Versions prior to the June 30, 2026 patch
  • Path traversal leading to arbitrary code execution

    • Langflow

  • Versions prior to 1.9.1
  • Cross-tenant IDOR vulnerability allowing unauthorized workflow execution
  • Often chained with prior RCE flaws for full compromise

    • Joomla Extensions

  • SP Page Builder by JoomShaper: versions prior to 6.6.2

    • - Affects the custom icon upload feature accessible without authentication

  • Page Builder CK by Joomlack: versions prior to 3.6.0

    • - Arbitrary file upload vulnerability in page builder components


    ## Mitigations


    Immediate Actions (by July 10):

  • Apply the latest security patches for ColdFusion immediately if running this platform in production
  • Update Langflow to version 1.9.1 or later; isolate Langflow instances from untrusted networks pending patching
  • Disable or uninstall SP Page Builder and Page Builder CK extensions until version 6.6.2 and 3.6.0 respectively can be deployed
  • If immediate patching is impossible, remove the affected Joomla components entirely from public-facing websites

    • Network-Level Protections:

  • Restrict ColdFusion, Langflow, and Joomla administrative interfaces to trusted IP ranges and VPNs
  • Implement Web Application Firewall (WAF) rules to block suspicious file upload requests and path traversal patterns targeting these platforms
  • Monitor web server logs for suspicious icon upload requests and file write operations in web-accessible directories
  • Implement strict Content Security Policy (CSP) headers to limit PHP execution from uploaded file directories

    • Detection and Response:

  • Search web logs for POST requests to the custom icon upload endpoint and suspicious file uploads to the web root
  • Check for unexpected administrator user accounts created after the suspected exploitation window (post-June 26)
  • Scan for PHP file manager backdoors and webshell artifacts on affected systems
  • Review file system permissions to ensure uploaded files cannot be executed by the web server process

    • Longer-Term Hardening:

  • Adopt a patch management policy that prioritizes critical CVEs within 48 hours of release
  • Segment production websites by purpose; isolate plugins with poor security track records on separate infrastructure
  • Maintain an inventory of all Joomla plugins and extensions; audit quarterly for abandoned or unmaintained components

    • ## References


  • [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities)
  • [Adobe ColdFusion Security Advisory](https://www.adobe.com/security)
  • [Langflow GitHub Security Notice](https://github.com/langflow-ai/langflow)
  • [Sysdig Threat Research: Langflow Exploitation Report](https://sysdig.com)
  • [CISA Binding Operational Directive 26-04](https://www.cisa.gov/directives)

    • ---


    ## HackWire Analysis


    What makes this batch of vulnerabilities particularly concerning is not just their severity, but the acceleration of exploitation timelines. The ColdFusion patch dropped June 30; exploits appeared within days. Page Builder CK was patched June 27; threats actors weaponized it within hours. This compression is no accident—it reflects a sophisticated threat landscape where critical CVE details are harvested from patch diffs, reverse-engineered into working exploits, and deployed through automated scanning and exploitation pipelines faster than defenders can react.


    The Langflow incident reveals a deeper trend: AI and ML infrastructure is becoming an attractive target. Langflow allows users to design and execute AI workflows through a visual interface. When an attacker exploits the cross-tenant IDOR, they don't just gain code execution—they gain access to workflow definitions, API credentials embedded in those workflows, and potentially sensitive data flowing through AI applications. The observed attack pattern (reconnaissance → ID harvesting → IDOR chaining with prior RCE) shows mature threat actors treating Langflow as an entry point to valuable data and compute resources.


    For Joomla site operators, the pattern of hidden administrator accounts and PHP file managers is a red flag for long-term compromise operations. These aren't one-off attacks; they're staging points for persistent access. Attackers are likely maintaining footholds to harvest databases, plant ransomware, or pivot deeper into organizational networks. Organizations running these extensions should assume they've been targeted—patching alone isn't sufficient. Forensic investigation and full credential rotation should be mandatory.


    The federal mandate (BOD 26-04, 3-day deadline) underscores CISA's assessment of risk. For the rest of the private sector not bound by this directive: treat this as if you have the same deadline. These flaws are trivial to exploit at scale; vulnerability scanners will light them up within days, and adversaries will pivot quickly to unpatched instances. Delay beyond a few days transforms a patch-and-move-on incident into a breach.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)