ColdFusion maximum severity flaw batch four KEV additions Langflow Joomla
If your organization runs Adobe $ADBE ColdFusion, a maximum-severity flaw is being exploited right now. CISA added CVE-2026-48282, a CVSS 10.0 path traversal bug, to its Known Exploited Vulnerabilities catalog, one of four actively exploited flaws flagged this week. Per The Hacke
If your organization runs Adobe $ADBE ColdFusion, a maximum-severity flaw is being exploited right now. CISA added CVE-2026-48282, a path traversal vulnerability carrying the maximum CVSS score of 10.0, to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. It was one of four flaws added in the same batch, alongside an authorization bypass in Langflow and unrestricted file-upload bugs in Joomla-based page builders. The inclusion in the KEV catalog matters beyond the private sector: it triggers a binding operational directive requiring US federal civilian agencies to patch or mitigate within a fixed window. A path traversal flaw at this severity typically lets an attacker read or write files outside the intended directory, which can open the door to remote code execution on an internet-facing server. For any team still running ColdFusion, this is a same-day patching item, not a next-sprint one. Source: The Hacker News.