CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued another urgent warning to organizations by adding four actively exploited security vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. This latest inclusion signals that threat actors are already leveraging these flaws in real-world attacks, creating immediate risks for unpatched systems. The addition to the KEV catalog underscores the critical nature of these vulnerabilities and mandates swift action from federal agencies and potentially all organizations utilizing the affected software products. The vulnerabilities impact widely used software from Adobe, Joomla, and Langflow, expanding the potential attack surface across numerous enterprise environments.

Among the newly cataloged vulnerabilities is CVE-2026-48282, a critical path traversal flaw in Adobe ColdFusion rated with a maximum CVSS score of 10.0. This particularly severe weakness could enable attackers to execute arbitrary code within the context of the vulnerable application, potentially leading to complete system compromise. While the source article was cut off, similar CISA alerts typically include additional vulnerabilities in popular content management systems like Joomla and emerging platforms such as Langflow, indicating a diverse range of potential attack vectors currently being exploited in the wild. These flaws collectively affect organizations across multiple sectors, with particular risk to those relying on Adobe products