A milestone in cybersecurity history was quietly logged on July 7, 2026, when the U.S. Cybersecurity and Infrastructure Security Agency added four vulnerabilities to its Known Exploited Vulnerabilities catalog — including one in Langflow, an open-source visual builder for AI agent pipelines. It is the first time an AI agent orchestration platform has appeared in the KEV catalog. Federal civilian agencies have until July 10 to apply fixes under Binding Operational Directive 26-04. For the rest of the industry, the additions are a loud signal: AI infrastructure is now a primary attack surface, and the threat actors pursuing it know exactly what they are looking for.
Four CVEs, One Landmark Entry
The four vulnerabilities span commercial web infrastructure, open-source content management extensions, and — in a first for the agency — a platform designed specifically to build and deploy AI agents.
CVE-2026-48282 is a path traversal flaw in Adobe ColdFusion carrying a perfect CVSS score of 10.0. Adobe patched it on July 1 as part of a seven-flaw advisory. Within hours of that disclosure, exploitation attempts were recorded from an IP address geolocated to India — a timeline suggesting automated scanner infrastructure rather than targeted manual intrusion. ColdFusion now carries 16 prior CVEs in the KEV catalog, a figure that reflects the platform’s deep embedding in legacy government and financial sector web applications where patching cycles chronically lag.
CVE-2026-48908 and CVE-2026-56290 are maximum-severity flaws in two popular Joomla page builder extensions: JoomShaper SP Page Builder and Joomlack Page Builder CK, respectively. Both allow unauthenticated visitors to upload arbitrary PHP files to the web server, providing immediate remote code execution. Researchers at mySites.guru documented zero-day exploitation of both issues before patches were available, with attackers using file upload access to create privileged Super User accounts and plant web shells throughout the Joomla directory structure. In at least one confirmed case, a shell appeared at /media/com_pagebuilderck/gfonts/bhup.php — a path designed to blend into a legitimate fonts directory. Users of SP Page Builder should update to version 6.6.2 or later; Page Builder CK users to version 3.6.0 or later.
The fourth addition — and the one most likely to redefine how organizations think about AI infrastructure risk — is CVE-2026-55255 in Langflow.
Why the Langflow Flaw Matters Far Beyond Its CVSS Score
CISA’s formal entry lists CVE-2026-55255 at CVSS 6.1. KEVIntel and the CIRCL vulnerability database assign the same flaw a 9.9. The gap is not a clerical error — it reflects a genuine scoring disagreement about how to weight cross-tenant scope impact — and understanding that gap tells administrators something useful about the nature of the threat.
The vulnerability is a cross-tenant insecure direct object reference (IDOR) in Langflow’s API. When an authenticated user submits a flow ID to the /api/v1/responses endpoint, the application executes that flow without first checking whether the requesting user actually owns it. A legitimate flow lookup and an unauthorized cross-user flow lookup were handled identically. The fix, shipped in Langflow 1.9.2, adds a single ownership check: if the flow’s stored user_id does not match the authenticated session’s user_id, the endpoint returns a 404 rather than running the flow.
What the CVSS 6.1 rating does not fully capture is what Langflow flows contain. The platform is designed to wire AI language models to production databases, cloud APIs, third-party services, and internal infrastructure. Flows routinely hold OpenAI API keys, AWS and Azure credentials, database connection strings, and OAuth tokens. An attacker who can execute another user’s flow using that user’s credentials is effectively operating with a full copy of the victim’s credential store — invisibly, through the platform’s own legitimate execution path.
Cloud security firm Sysdig documented exactly this exploitation pattern during June 22–25, 2026, when a single operator at IP address 45.207.216[.]55 combined CVE-2026-55255 with CVE-2026-33017 — a companion unauthenticated remote code execution flaw — against the same internet-exposed Langflow instance. The attack sequence was methodical: authenticate, enumerate flow IDs via the /api/v1/flows/ listing endpoint, replay harvested IDs via the IDOR to “leak api keys” (the operator’s verbatim prompt payload), then pivot to the RCE for host-level access and second-stage payload delivery. Sysdig assessed the campaign as financially motivated, consistent with credential harvesting for cryptojacking operations.
The stealthiness of the IDOR is the critical detail for detection teams. The RCE injection produces anomalous Python activity that modern endpoint detection tools are tuned to surface. The IDOR is a legitimate API call — the only anomaly is a wrong flow ID in the request logs. On a well-monitored single-tenant deployment, the RCE is the easier win. On a managed or multi-tenant Langflow instance where each tenant’s execution is sandboxed, the IDOR becomes the only path that crosses tenant boundaries — and it does so silently, below the noise threshold of most deployed detection systems.
JADEPUFFER: When the AI Agent Is the Ransomware
Last week delivered a related disclosure that adds urgency to the Langflow security picture. Sysdig published research on JADEPUFFER — assessed as the first documented case of fully autonomous agentic ransomware. The entry point for JADEPUFFER was CVE-2025-3248, a Langflow authentication bypass patched in May 2025 and added to the KEV catalog that same month. The targeted server had never been updated.
Once inside, the LLM-driven agent worked without human direction: it enumerated the host, swept the environment for API keys across multiple providers (OpenAI, Anthropic, DeepSeek, Gemini) and cloud credentials spanning AWS, Azure, Google Cloud, Alibaba, Tencent, and Huawei, then pivoted to a separate production MySQL database and Nacos configuration service. The agent encrypted 1,342 configuration items, deleted the originals with no recovery key stored or transmitted, and left a ransom note. From initial access to ransom delivery, the operation was autonomous.
The JADEPUFFER disclosure underlines why Langflow has accumulated seven distinct CVEs in active or recent exploitation over the past 14 months — a rate that reflects structural attractiveness, not a single design failure. A platform built to connect AI models to production credentials and data is, by design, a master key ring. Compromising it doesn’t just expose a host machine; it can expose every cloud environment connected to the agent’s credential store.
What Needs to Happen Now
For Langflow operators, the minimum required action is updating to version 1.9.2. But patching alone is insufficient for instances that were internet-accessible before the update. The IDOR’s design — a normal API call with a mismatched flow ID — leaves no footprint distinguishable from legitimate traffic except in careful API log analysis. Sysdig recommends auditing /api/v1/responses access logs for cross-user flow ID patterns, and treating credential rotation as mandatory rather than precautionary for any internet-exposed instance regardless of whether exploitation is confirmed. Every API key, LLM provider credential, and cloud access token stored in any flow should be considered compromised and rotated.
For Adobe ColdFusion administrators, the patches from the July 1 APSB26-68 advisory address CVE-2026-48282. Given that exploitation began within hours of public disclosure and ColdFusion’s persistent presence in the KEV catalog, any ColdFusion server accessible from the internet should be treated as a fire-drill-category patch regardless of testing timelines. If compromise is suspected, CISA’s Forensics Triage Requirements direct agencies to preserve evidence before patching rather than overwriting a potentially compromised state.
For Joomla site operators running SP Page Builder or Page Builder CK, updates to 6.6.2 and 3.6.0 respectively are available. After patching, administrators should conduct a manual directory sweep — not just the extension’s expected media path, but /images, /media, /templates, and /administrator — for unexpected PHP files. The exploitation technique of choosing arbitrary destination folders means a planted web shell may be anywhere in the file system.
The Broader Signal
The addition of Langflow to the KEV catalog is a practical warning that the security perimeter has expanded to include the AI infrastructure layer. Every organization that has deployed AI agent platforms — whether Langflow or similar visual pipeline builders — needs to apply the same patch-and-audit discipline to those systems that it applies to web servers and databases. The JADEPUFFER disclosure shows that unpatched AI infrastructure is not merely a passive credential exposure risk: it is an autonomous ransomware entry point.
CISA’s KEV catalog entry requires confirmed real-world exploitation, not theoretical risk. When a vulnerability lands there, exploit code is almost certainly circulating and real organizations have already been hit. The question for any organization running Langflow 1.9.1 or earlier is not whether attackers have noticed. It is how long ago they did.
