CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV

Executive Summary

CISA added four exploited flaws to KEV, including ColdFusion path traversal CVE-2026-48282 (CVSS 10.0) and a Langflow flaw.

What Happened

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-48282 (CVSS score: 10.0) - A path traversal vulnerability in Adobe ColdFusion that could lead to arbitrary code execution in the context of the

Affected Products

Adobe ColdFusion
Langflow
Joomla

Vulnerability / Attack Technique

Exploited vulnerabilities including AI workflow RCE

Technical Mechanism

KEV addition.

AI Security Category

LLM03:2025 Supply Chain

Part of the AI Supply Chain and AI SBOM topic.

Relevant Frameworks

LLM03:2025 Supply Chain

RealGround Analysis

AI workflow tools are routine targets.

Recommended Controls

Update Langflow

Related RealGround Service

AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.

Sources

thehackernews.com: https://thehackernews.com/2026/07/cisa-adds-4-actively-exploited-adobe.html

Summary and analysis written by RealGround from the source above; last updated 2026-10-18.