Adobe ColdFusion leads seven CVEs now confirmed exploited

Seven vulnerabilities are now confirmed exploited. CISA added all of them to its Known Exploited Vulnerabilities (KEV) catalog between July 7 and July 13, and that listing is the evidence that pulls them to the front of a patch queue, ahead of whatever severity score sits next to them. The set is unusually broad this week: an Adobe ColdFusion path traversal, an authorization bypass in the Langflow AI platform, an 18-year-old Cisco IOS flaw, and four Joomla extensions that share one unauthenticated route from file upload to code execution.

Severity is not what ties them together. Their CVSS scores run from 8.4 to 10.0, and their modelled exploitation likelihood (EPSS) ranges from 0.6% to 28.6%. What they have in common is a KEV entry, the one signal here built on observed attacks rather than a forecast.

Three acronyms run through this digest. CVSS scores how damaging a flaw would be if someone exploited it, on a 0 to 10 scale. EPSS estimates the chance it gets exploited in the next 30 days, shown here as a percentage. KEV is CISA’s catalog of flaws with confirmed real-world attacks. Severity and likelihood are not the same thing. The full method is in our CVSS vs EPSS vs KEV breakdown.

What’s now confirmed exploited this week

Seven CVEs entered the confirmed-exploited column this week. One hits a widely deployed application server, one an AI workflow platform, one a class of legacy network gear, and four hit Joomla add-ons that share a single weakness. They are grouped below by footprint, largest first.

CVE-2026-48282: Adobe ColdFusion

CVE-2026-48282 is a path traversal flaw (CWE-22) in Adobe ColdFusion that can lead to arbitrary code execution in the context of the current user, with no user interaction required. NVD lists ColdFusion 2025.9, 2023.20 and earlier as affected. ColdFusion runs application back ends for a long tail of enterprise and government sites, so an internet-facing instance is a direct path from an unauthenticated request to code on the server.

CVSS base score: 10.0 (Critical). EPSS: 28.6% (98th percentile). CISA added it to KEV on July 7, 2026.

This is the highest EPSS in the set by a wide margin, so for once the model and the KEV entry agree. Apply Adobe’s security update for your ColdFusion version, and treat any public-facing instance as first in line.

CVE-2008-4128: Cisco IOS

CVE-2008-4128 is a set of cross-site request forgery flaws (CWE-352) in the HTTP administration component of Cisco IOS 12.4, documented on the 871 Integrated Services Router. An attacker who gets a logged-in administrator to load a crafted page can push privileged commands to the device’s web interface. The affected software is old, but KEV listing it in 2026 is a reminder that attackers still find and hit forgotten edge gear running end-of-life IOS.

CVSS base score: 9.3 (High). EPSS: 12% (96th percentile). CISA added it to KEV on July 13, 2026.

NVD’s primary score here is CVSS 2.0. A later CVSS 3.1 assessment in the same record rates the flaw 4.3 (Medium), which shows how rarely a single number settles urgency on its own. If you still run IOS 12.4 anywhere, disable the HTTP admin interface or restrict it to a management network.

CVE-2026-55255: Langflow

CVE-2026-55255 is an insecure direct object reference (CWE-639) in Langflow, the open-source tool for building AI agents and workflows. On the /api/v1/responses endpoint, an authenticated attacker can run a flow that belongs to another user by supplying the victim’s flow ID. NVD lists versions before 1.9.1 as affected; the fix is in 1.9.1.

CVSS base score: 8.4 (High). EPSS: 0.6% (43rd percentile). CISA added it to KEV on July 7, 2026.

This carries the lowest EPSS in the set and the widest gap between model and evidence. If your team stood up Langflow to prototype an AI feature, it may not be in your asset inventory at all. Find it, then upgrade to 1.9.1 or later.

Four Joomla extensions: one file-upload path to RCE

Four Joomla add-ons landed on KEV this week for one shared weakness: an unrestricted file upload (CWE-434) that lets an attacker drop and run PHP code, in each case without authenticating. Every ID links to its NVD detail:

• CVE-2026-56290, Page Builder CK (Joomlack): unauthenticated arbitrary file upload leading to full RCE. CVSS base score: 9.8 (Critical). EPSS: 2.9% (85th percentile). Added to KEV July 7, 2026.
• CVE-2026-48908, SP Page Builder (JoomShaper): unauthenticated upload and execution of PHP code. CVSS base score: 9.8 (Critical). EPSS: 1.6% (72nd percentile). Added to KEV July 7, 2026.
• CVE-2026-48939, iCagenda: arbitrary file upload in the attachment feature, ending in PHP execution. CVSS base score: 9.8 (Critical). EPSS: 1.5% (71st percentile). Added to KEV July 10, 2026.
• CVE-2026-56291, Balbooa Forms: unauthenticated arbitrary file upload leading to full RCE. CVSS base score: 9.8 (Critical). EPSS: 0.8% (53rd percentile). Added to KEV July 10, 2026.

If you run Joomla, the practical move is to inventory installed extensions and check each against its vendor’s fixed release. One vulnerable form or page-builder add-on is enough to hand over the whole site. Where a fix is not yet available, take the extension offline rather than leave an unauthenticated upload endpoint exposed.

Why the EPSS spread is so wide

All seven are confirmed exploited, yet their EPSS scores span nearly two orders of magnitude, from 0.6% to 28.6%. That is not a contradiction. EPSS forecasts exploitation from public signals: published exploit code, scanner traffic, advisory chatter. Those signals accumulate at different speeds. A widely discussed ColdFusion bug builds them fast; a niche Joomla extension, or a flaw only just weaponized, may show almost none even while it is being used against real targets.

KEV closes that gap by recording confirmed exploitation directly. The rule that follows is simple. Use EPSS to rank the CVEs that are not yet on KEV. Once a CVE is on KEV, its EPSS number stops being the deciding factor: the exploitation is already confirmed, and the patch is due.

What to change in your queue this week

Three moves for this week:

1. Patch the two broad-footprint entries first. The ColdFusion path traversal and the Cisco IOS flaw carry the highest exploitation likelihood in the set. Apply Adobe’s update on any ColdFusion instance, and shut off or lock down the HTTP admin interface on legacy IOS.
2. Sweep Joomla by extension, not by core version. The four add-on CVEs share a file-upload class that core patching will not touch. Reconcile your installed extensions against vendor fixed releases, and pull anything unpatched offline.
3. Find the shadow AI tools. Langflow is the kind of service a team spins up outside the normal asset process. If it is not in your inventory, it is not in your patch queue either, and its low EPSS score is exactly why it will not surface on its own.

The pattern holds every week these digests run: the CVEs that earn the first engineering hour are the ones with exploitation evidence behind them, not the ones with the biggest severity number. This week that evidence points at ColdFusion and Cisco first, then the Joomla wave, with Langflow as the reminder that a low EPSS score never means safe when KEV says otherwise.