Three vulnerabilities rated CVSS 10.0 entered the CISA Known Exploited Vulnerabilities catalog during a 48-hour window from July 7 to 9. Adobe ColdFusion and two Joomla-ecosystem components are all confirmed under active exploitation. Federal agencies faced a July 10 remediation deadline — today. The same KEV update also added the first AI agent platform to the catalog.
The ColdFusion Critical: CVE-2026-48282
Adobe ColdFusion, the application server platform widely used in government portals, financial services web applications, and legacy enterprise systems, carries the most severe entry in this batch. CVE-2026-48282 is a CVSS 10.0 remote code execution vulnerability. The flaw allows an unauthenticated attacker to execute arbitrary code on the ColdFusion server without any user interaction. No authentication is required. No user needs to open a link or trigger a process.
ColdFusion has featured in KEV additions before, and the pattern is consistent: internet-facing ColdFusion instances are scanned and exploited rapidly once a vulnerability is disclosed. The platform’s footprint in government web infrastructure makes it a sustained priority target. Organisations running ColdFusion should assume that unpatched internet-facing instances are already under active reconnaissance.
Adobe’s July 2026 security bulletin includes the patch. Versions of ColdFusion running on out-of-support releases should be treated as already compromised if they have any external network exposure.
Two Joomla CVSS 10.0 Entries: CVE-2026-56290 and CVE-2026-48908
The same KEV window also added two Joomla-ecosystem components. CVE-2026-56290 affects Joomlack, a Joomla extension; CVE-2026-48908 affects JoomShaper, a page builder used widely for Joomla-based web presences. Both carry CVSS 10.0 ratings with authentication bypass to remote code execution as the attack chain.
The impact of both flaws is the same in practice: an unauthenticated attacker can take full administrative control of the affected Joomla site. From that position, web shells, credential harvesting, and ransomware pre-positioning are all documented follow-on actions in prior Joomla exploitation campaigns.
Joomla powers a significant proportion of nonprofit, media, and public sector websites. Organisations that have deployed either extension should treat this as a critical patch priority irrespective of the federal deadline. The active exploitation status in the KEV catalog reflects attacks already underway — not a theoretical future risk.
Neither the core Joomla CMS nor unaffected extensions carry these CVEs. Operators need to confirm specifically whether Joomlack or JoomShaper are installed and update to the patched versions the vendors have released.
Langflow in KEV: The First AI Agent Platform
CVE-2026-55255 is an insecure direct object reference in Langflow that allows unauthorised access to objects and credential theft. CVSS 6.1, lower than the ColdFusion and Joomla entries but notable for a different reason: this is the first time an AI agent platform has appeared in the KEV catalog, confirming that threat actors are targeting Langflow instances in the wild.
Langflow has accumulated four separate CVE entries in 2025 and 2026, with CVE-2026-33017 (unauthenticated RCE) previously added to KEV. The CVE-2026-55255 IDOR adds credential theft to the confirmed exploitation surface. Organisations running Langflow in production — which covers a meaningful share of enterprise AI pipeline infrastructure — should apply the latest Langflow release and audit which credentials are accessible to the application’s object references.
What This Batch Signals
Three CVSS 10.0 entries in 48 hours represents a significant KEV pulse. The common thread is web application infrastructure: ColdFusion servers, Joomla installations, and AI workflow platforms all present as internet-facing web services where unauthenticated access creates immediate and severe impact.
Organisations that have not already moved beyond basic vulnerability scanning to confirmed patch verification for these platforms should do so now. The federal July 10 deadline is not a useful guide for private sector urgency — CISA’s KEV designations reflect confirmed exploitation that began before the catalog entry, not a starting gun for attackers.
Immediate actions:
- Identify and patch all ColdFusion instances, prioritising internet-facing deployment
- Audit Joomla installations for Joomlack and JoomShaper and update both immediately
- Update Langflow to the current release; audit application credential exposure
- For any of these systems that cannot be immediately patched, restrict external network access until patching is complete