Four Gaps in the KEV – One Takes Cloud Key Away
On July 7, the US agency CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog and gave its federal agencies just three days to patch them. Affected systems include Adobe ColdFusion, two Joomla frameworks, and Langflow-a tool for building AI agents. For German security teams, this list isn’t just a US administrative act-it’s a prioritization signal.
Key Takeaways
- Four in one day. CISA lists ColdFusion, Langflow, and two Joomla page builders as actively exploited; the patch deadline for US agencies expired on July 10.
- Exploitation outweighs score. A KEV entry documents a real-world attack-stronger motivation to patch than a high CVSS score alone.
- AI tools in the crosshairs. Langflow appears in the catalog for the second time. Attackers used the flaw to steal cloud and AI keys.
Related: Type Confusion in Chrome’s V8: The Bug That Keeps Coming Back · The Backdoor in Nearly Every German Web-Hosting Contract
Four Gaps, a Three-Day Deadline
What is the CISA KEV catalog? The Known Exploited Vulnerabilities list highlights flaws for which the US agency CISA has confirmed real-world exploitation. Each entry signals an attack observed in the wild, backed by concrete incidents.
Three of the four entries carry the maximum score of 10.0; the Langflow case sits at 9.9. In Adobe ColdFusion, a path-traversal flaw enables remote code execution-Adobe only released the patch on 30 June. Two Joomla extensions, SP Page Builder and Page Builder CK, can be hijacked without authentication via file upload. Yet one entry stands out.
| Product | CVE | CVSS | Vulnerability | Fixed in Version |
|---|---|---|---|---|
| Adobe ColdFusion | CVE-2026-48282 | 10.0 | Path Traversal, Code Execution | 2025 Update 10 / 2023 Update 21 |
| Langflow | CVE-2026-55255 | 9.9 | Cross-Tenant Access (IDOR) | 1.9.1 |
| SP Page Builder | CVE-2026-48908 | 10.0 | Unauthenticated File Upload, RCE | 6.6.2 |
| Page Builder CK | CVE-2026-56290 | 10.0 | Unauthenticated File Upload, RCE | 3.6.0 |
The tight deadline is no accident. Since directive BOD 26-04, CISA has prioritized risk over fixed time windows. When attack surface, KEV status and technical impact align, the window shrinks to three days. German firms aren’t legally bound by the deadline, yet the signal-showing which gaps are actively exploited-still matters.
Why an AI Building Kit in the Crosshairs
Langflow is an open-source tool that lets teams click together LLM workflows and AI agents. Such instances often run self-hosted in development, stuffed with real credentials. That’s precisely what makes them valuable targets.
CVE-2026-55255 is an inter-tenant access flaw. An attacker executes workflows under a foreign flow ID, gaining access to resources they don’t own. Researchers at Sysdig watched attackers leverage this route to exfiltrate stored keys via prompt: OpenAI, Anthropic and AWS tokens ended up outside. A hijacked dev tool thus becomes a launchpad straight into the cloud.
What’s striking is the repeat. Back in March, Langflow appeared again with another critical entry. Two strikes in a few months reveal a pattern: AI dev tools are becoming their own attack surface, frequently installed outside the security team’s line of sight.
What the entry means for German teams
Formally, the CISA deadline only applies to US federal agencies. In practice, however, many German teams have long treated the KEV catalog as an early-warning system. It answers the question that internal scoring models leave open: Which vulnerability is currently being exploited in the wild?
This question carries weight because the gap between attack and response is widening. Why a high CVSS score alone doesn’t determine priority has been covered in detail elsewhere. Here, the practical point matters: a KEV entry turns a “should-fix” into a “must-fix.”
new vulnerabilities registered by BSI per day, up 24 percent
median time to patch, up from 32 (Verizon DBIR 2026)
of security incidents begin with an exploited vulnerability (Verizon DBIR 2026)
When you weigh 119 new vulnerabilities per day against a 43-day patch cycle, you can’t close everything at once. The KEV catalog provides the tie-breaking rule.
Setting the priority in your own environment
The first step is unglamorous yet critical: know what’s running. Without an up-to-date asset inventory, every KEV alert remains abstract.
Check immediately
- ✓Cross-check inventory: Is ColdFusion, Langflow, or either of the two Joomla extensions running in your environment? Which versions?
- ✓Apply patches: ColdFusion 2025 Update 10 or 2023 Update 21, Langflow 1.9.1, SP Page Builder 6.6.2, Page Builder CK 3.6.0.
- ✓For Langflow, rotate every stored credential: OpenAI, Anthropic, AWS keys, and database secrets.
- ✓Inspect logs: unexpected upload calls in Joomla, foreign flow executions in Langflow.
- ✓Treat publicly exposed instances first, internal systems afterward.
With Langflow, the patch isn’t enough. If you had the affected version in production, assume credentials have already leaked. Rotating keys is part of the remediation, not a later maintenance task.
Frequently Asked Questions
Each question is locked. Clicking it unlocks the answer.
What does inclusion in the KEV catalog mean?
CISA only lists a vulnerability when active exploitation has been confirmed. The entry represents a verified in-the-wild attack, not a theoretical risk-distinct from a plain CVSS score.
Does the CISA deadline also apply to German companies?
Legally, no. The deadline only binds U.S. federal agencies. Many German security teams, however, treat the catalog as an early-warning signal because it highlights which gaps are actively being exploited.
Which of the four vulnerabilities is the most urgent?
That depends on your own inventory. Publicly reachable ColdFusion servers and unprotected Joomla sites are immediately exposed. Langflow deserves extra attention because exposed credentials may already have leaked, so patching alone isn’t enough.
Why is Langflow particularly risky?
The tool often stores real AI and cloud access keys and frequently runs outside official IT oversight. The flaw lets attackers extract those keys, opening a path into connected cloud environments.
Is applying the patches sufficient?
For ColdFusion and the Joomla extensions, the patch closes the gap. With Langflow, you must also rotate every stored credential because those keys may already be compromised.
Editor’s Reading Picks
Reading TipOAuth Token Theft: How Attackers Bypass MFAReading TipIvanti Connect Secure Back in CISA KEV: Third Incident in 18 MonthsReading TipThe Splunk Flaw That Wipes Files Without a Login
More from the MBF Media Network
cloudmagazinFor the first time ever, you can watch an AI thinkMyBusinessFutureFor manufacturers who want more – How a GTIA membership strengthens your entire partner networkDigital ChiefsThe IT department decides whether the spin-off pays off
Image source: AI-generated (July 2026)
