CISA Flags Three Actively Exploited Vulnerabilities in Joomla and Langflow

In a proclamation underscoring the persistent vulnerability of modern web infrastructure, the Cybersecurity and Infrastructure Security Agency (CISA) has added three new entries to its Known Exploited Vulnerabilities (KEV) catalog. The update, issued on July 7, 2026, targets critical flaws in widely used Joomla extensions and an AI workflow platform, signaling that threat actors are actively leveraging these weaknesses in the wild.

The Anatomy of the Exploited Flaws

The newly cataloged vulnerabilities represent a confluence of legacy web application risks and emerging AI infrastructure exposures. The first, CVE-2026-48908, affects JoomShaper SP Page Builder, allowing unauthenticated users to upload arbitrary files with dangerous types, potentially leading to remote code execution. The second, CVE-2026-56290, involves an improper access control mechanism in Joomlack Page Builder, creating a similar pathway for compromise.

Perhaps most alarming is the third addition, CVE-2026-55255, which impacts Langflow, an open-source tool for building AI agents and workflows. This authorization bypass flaw allows a user-controlled key to circumvent security checks, granting unauthorized access to sensitive workflow data and API tokens. As AI orchestration platforms become increasingly ubiquitous, they are rapidly becoming prime targets for sophisticated threat actors.

Federal Directives and Operational Impact

This update arrives in the wake of Binding Operational Directive (BOD) 26-04, which mandates that federal civilian agencies prioritize vulnerability remediation based on real-world risk rather than abstract severity scores. Under this framework, the presence of a vulnerability on the KEV list transforms it from a passive advisory into an imperative for rapid patching. While private sector entities are not legally bound by BOD 26-04, the operational logic is universally applicable: if a flaw is exposed, exploited, and automatable, it demands immediate attention.

Remediation and Threat Hunting

Security teams are urged to immediately identify any instances of JoomShaper SP Page Builder, Joomlack Page Builder, or Langflow within their environments. For the Joomla extensions, administrators must verify the installed versions and apply the latest vendor patches. Crucially, because these flaws have been actively exploited, patching alone is insufficient; organizations must also conduct thorough threat hunting to identify any post-exploitation artifacts, such as unauthorized file uploads, new administrative accounts, or suspicious outbound connections.