CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV
Summary: CISA added four flaws to its KEV catalog on Tuesday, citing active exploitation: CVE-2026-48282, which saw an exploitation attempt from an IP geolocated to India within hours of disclosure; CVE-2026-48908, exploited as a zero-day in SP Page Builder to upload a PHP file and create a Super User account; CVE-2026-56290, used to deliver a web shell via Page Builder CK; and CVE-2026-55255, a cross-tenant IDOR in Langflow that Sysdig observed a lone operator at 45.207.216[.]55 chaining with the CVE-2026-33017 RCE between June 22 and 25, 2026. FCEB agencies are advised to apply fixes by July 10, 2026.
Bottom line: The Langflow operator stole LLM provider keys and AWS keys from other tenants, and Sysdig assessed the activity as opportunistic and financially motivated - meaning credential theft from AI orchestration platforms is already a working business model, not a hypothetical.