On **7\u20138 July 2026**, per **The Hacker News** and **SecurityWeek**, the US Cybersecurity and Infrastructure Security Agency (**CISA**) added four actively exploited vulnerabilities to its **Known Exploited Vulnerabilities (KEV) catalog** and set a federal civilian remediation deadline of **10 July 2026**. Federal agencies must patch or mitigate by that date under Binding Operational Directive 22-01. The KEV catalog is not a federal-only signal: for mid-market buyers it is the single most reliable public shortlist of vulnerabilities that are being exploited in the wild right now, and the associated deadlines are a reasonable proxy for the patch cycle any organisation should be running against its own estate.
Three of the four July 10 additions share a shape that matters more than any individual line item. They are **CVSS 10.0**, **unauthenticated**, **remote-code-execution** flaws in the software that renders and edits public websites \u2014 an application server and two content-management-system page builders. The fourth is an authorisation-bypass in an AI-orchestration platform that has already been chained into a full remote-code-execution intrusion. The composition of the batch is the story.
The public website layer \u2014 the CMS core, the page-builder plugins and themes, the legacy application servers hosting older marketing sites and portals \u2014 has become an unauthenticated remote-code-execution surface with exploitation windows measured in **hours**, not weeks. Most mid-market companies have no operating model for it, because marketing owns the content, IT owns the servers, and **nobody owns the plugins**. This article is the buyer\u2019s response.
**CVE-2026-48282 \u2014 Adobe ColdFusion path traversal, CVSS 10.0.** Per **Ryan Dewhurst**, security researcher and maintainer of **KEVIntel**, exploitation of the ColdFusion path-traversal flaw was **observed within hours of public disclosure**. ColdFusion is a legacy application server: still deployed, still internet-facing, and still hosting workloads that outlived the teams who built them. A CVSS 10.0 with an hours-long exploitation window against a legacy app server is the worst possible combination for organisations whose ColdFusion estate is documented on a wiki page last edited in 2019.
**CVE-2026-48908 \u2014 JoomShaper SP Page Builder for Joomla, CVSS 10.0.** Per **mySites.guru**, this flaw was exploited as a **zero-day**: an unauthenticated file-upload endpoint was abused to plant PHP web shells, followed by creation of a **rogue Super User account** for persistent, out-of-band administrative access. The vendor patch ships in **version 6.6.2**. Any Joomla site running an older SP Page Builder version should be treated as compromised until proven otherwise.
**CVE-2026-56290 \u2014 PageBuilder CK for Joomla, CVSS 10.0.** Also per **mySites.guru**, this is an **unauthenticated arbitrary file upload** where the attacker chooses the destination folder, which means planted web shells can be **anywhere on the site** \u2014 not confined to a predictable upload directory that an incident responder could grep in an hour. Exploitation and web-shell activity have been observed in the wild since **27 June 2026**. Fixed in **version 3.6.0**.
**CVE-2026-55255 \u2014 Langflow authorisation bypass (IDOR), CVSS 6.1.** Per **Sysdig**, the Langflow IDOR was chained by a financially motivated operator with a remote-code-execution flaw to steal other tenants\u2019 **LLM provider API keys and AWS credentials**. Sysdig frames AI orchestration platforms as a credential trove in their own right \u2014 a single compromised instance can leak the keys that pay for a competitor\u2019s inference and hosting bills.
The three CMS and application-server flaws are what most mid-market estates are exposed to. The Langflow entry is the AI-era equivalent \u2014 a new class of internet-facing platform that already holds enough sensitive material to be worth stealing on its own.
The reason the KEV catalog keeps filling with public-website RCEs is not that CMS software is unusually bad. It is that the operating model around it is unusually weak.
In a typical mid-market organisation the **CMS content** is owned by marketing or communications, who care about publishing cadence, campaign landing pages and brand consistency. The **underlying server, network and TLS** is owned by IT or a hosting partner, who cares about uptime, cost and change management. The **plugins, themes and page builders** \u2014 the third-party extensions that do the actual page composition and are, empirically, where the CVSS 10.0 flaws land \u2014 are owned by nobody. They are chosen by a marketing agency five years ago, installed once, never revisited. The vendor mailing list goes to a person who left. The auto-updater is off because it broke a landing page in 2023.
The Adobe ColdFusion case is the same failure mode wearing a different hat. Legacy application servers hosting a decade-old customer portal, an old careers site, a partner extranet nobody has decommissioned. The service is running because turning it off is a political decision no one wants to sign, and it is patched on a cadence that assumes attackers behave the way they behaved in 2016.
The July 10 KEV batch is not really a CVE list. It is an audit of that operating model.
The single most important operational fact in the KEVIntel observation on ColdFusion is the **hours-long** exploitation window. Traditional patch cadences for the public-website layer \u2014 quarterly maintenance windows, monthly change boards, "we\u2019ll bundle it with the next release" \u2014 assume attackers need days or weeks to weaponise a public advisory. In 2026 that assumption is dead for KEV-class vulnerabilities. The mySites.guru observation that PageBuilder CK web shells have been in the wild since 27 June 2026 \u2014 well before the KEV listing \u2014 says the same thing from the other direction: exploitation runs ahead of catalog inclusion, not behind it.
The corollary is that the window between "advisory is public" and "your unpatched instance is a shell" is now shorter than most mid-market change-management processes. A patch SLA measured in **hours** for internet-facing critical CVEs is not aggressive. It is the minimum viable posture.
The six controls below are the operational response. Every control is either standard practice or directly derived from the July 10 KEV batch. The value is in operating the set coherently, not in picking two.
You cannot patch what you cannot list. The first control is a written, versioned inventory of every internet-reachable web property \u2014 primary marketing site, campaign microsites, legacy portals, careers site, partner extranet, event registration pages, subdomains that used to host a product launch \u2014 with, for each, the CMS name and version, every installed plugin and theme and version, the underlying application server (Apache, IIS, ColdFusion, Node) and version, and the named human owner. External attack-surface-management scans catch what shadow-IT missed. Refresh cadence: monthly, with a diff review.
For any internet-facing property, the patch SLA for a **KEV-listed** or **CVSS 9.0+** advisory should be **24 hours** from vendor availability. For CVSS 10.0 unauthenticated RCEs \u2014 the shape of three of the July 10 KEV additions \u2014 the target is **hours**. That requires the change board to pre-authorise emergency patching for a defined category, and the hosting partner to have out-of-hours capacity contractually available. It is a governance change as much as a technical one.
Between advisory publication and clean deployment, a **web application firewall** with virtual-patching rules is the compensating control. For the July 10 batch specifically, the Joomla page-builder file-upload endpoints and the ColdFusion path-traversal patterns are all things a modern WAF ruleset can filter at the edge within minutes of a signature being available. Virtual patching is not a substitute for patching; it is the bridge that turns an hours-long exposure window into a signature-deployment window.
Once a page-builder file-upload flaw has been exploited, the artefact is a web shell somewhere on the filesystem. mySites.guru\u2019s note on PageBuilder CK \u2014 that the attacker chooses the destination folder \u2014 is the operational reason you cannot rely on grepping a single upload directory. The control is **filesystem integrity monitoring** across the entire document root, plus scheduled hunting queries that look for PHP or ASPX files in media directories, files with recent modification timestamps that do not correspond to a deployment, and outbound network callbacks from the web server process to unusual destinations.
The Joomla SP Page Builder exploitation chain ends in the creation of a **rogue Super User account**. Detection of that specific action is worth building explicitly: alerts on any newly created Super User, root, administrator or equivalent account across every CMS in the inventory, delivered to the security-operations rotation, not to a shared mailbox. Least-privilege day-to-day \u2014 no editor with admin rights, no shared credentials, MFA on every admin interface, admin surfaces behind an IP allow-list or a zero-trust proxy \u2014 raises the cost of the intrusion in the first place.
The final control is the one nobody wants to schedule and the only one that changes the trajectory. A ColdFusion server hosting a portal from 2014, a Joomla install running an abandoned page builder from a discontinued vendor, a WordPress instance running three plugins whose last release was in 2022 \u2014 these are not patch problems. They are decommission problems. The 2026 posture is a written **modernise-or-retire** plan for every legacy web property, with a target date, a budget line and a named executive owner. Modern maintained stacks (a current WordPress with a curated plugin allow-list, a headless CMS with a static front-end, a rebuilt marketing site on a current framework) collapse the attack surface and the patch cadence in one motion.
Public-website security in 2026 is not a project. It is a **standing capability** \u2014 inventory refresh, hours-scale patch response, WAF signature review, integrity monitoring, admin-account alerting, and a modernisation backlog that never fully empties. Building that internally at mid-market scale means a small team of web engineers, a WAF and monitoring stack, a 24/7 rotation for the hours-scale patch SLA, and a modernisation programme with real budget authority.
Call IT Dev delivers that capability as a managed model from a Morocco nearshore footprint. The [software development](/en/services/software-development) practice runs the CMS modernisation and legacy retirement work; the [cybersecurity](/en/services/cybersecurity) practice runs the patch cycle, WAF and virtual patching, web-shell hunting and admin-account monitoring; the [technical support](/en/services/technical-support) practice runs the 24/7 rotation. The commercial construct is set out on the [why Morocco](/en/why-morocco) page: nearshore time-zone alignment with EU and UK, English and French delivery depth, and a labour-cost basis that lets a mid-market buyer fund the full six-control stack rather than only the two they can currently staff.
The July 10 KEV additions are not a news story. They are an operational test of whether your organisation has answered the ownership question on its public website layer. If the honest answer is that marketing owns the content and IT owns the servers and nobody owns the plugins, the fix is a written operating model before the next batch lands.
${CTA_CMS}
Per The Hacker News and SecurityWeek reporting on 7\u20138 July 2026, CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog with a US federal civilian remediation deadline of 10 July 2026: CVE-2026-48282 (Adobe ColdFusion path traversal, CVSS 10.0), CVE-2026-48908 (JoomShaper SP Page Builder for Joomla, CVSS 10.0), CVE-2026-56290 (PageBuilder CK for Joomla, CVSS 10.0) and CVE-2026-55255 (Langflow authorisation bypass / IDOR, CVSS 6.1). Three of the four are unauthenticated remote-code-execution flaws in the public website layer.
For CVE-2026-48282 (Adobe ColdFusion) security researcher Ryan Dewhurst of KEVIntel observed exploitation within hours of public disclosure. For CVE-2026-56290 (PageBuilder CK) mySites.guru reports web-shell activity in the wild since 27 June 2026, before the KEV listing. For CVE-2026-48908 (JoomShaper SP Page Builder) mySites.guru documented exploitation as a zero-day, with unauthenticated file uploads used to plant PHP web shells followed by creation of a rogue Super User account for out-of-band administrative access. The operational implication is that quarterly patch cycles are no longer viable for internet-facing critical CVEs.
Because it is organisationally unowned. CMS content is owned by marketing, the underlying server is owned by IT or a hosting partner, and the plugins, themes and page builders \u2014 which is where the CVSS 10.0 flaws land \u2014 are owned by nobody. They were chosen by an agency, installed once, never revisited, the vendor mailing list goes to a person who left, and the auto-updater is off because it broke a landing page in 2023. The July 10 KEV batch is functionally an audit of that operating model.
One, a full inventory of every internet-reachable property with CMS, plugin, theme and app-server versions and a named owner, refreshed monthly. Two, a patch SLA in hours (not weeks) for KEV-listed or CVSS 9.0+ advisories on internet-facing assets. Three, a WAF with virtual-patching rules as the bridge between advisory and clean deployment. Four, web-shell hunting across the whole document root plus filesystem integrity monitoring \u2014 mySites.guru notes PageBuilder CK lets the attacker choose the destination folder, so grepping one upload directory is insufficient. Five, least-privilege admin with alerts on any newly created Super User or administrator account across every CMS. Six, a written modernise-or-retire plan for legacy CMS and page builders, with target dates, budget and named executive owner.
Per mySites.guru: CVE-2026-48908 in JoomShaper SP Page Builder is fixed in version 6.6.2; CVE-2026-56290 in PageBuilder CK is fixed in version 3.6.0. Any Joomla site running an older version of either extension should be treated as potentially compromised until proven otherwise, given the pre-KEV in-the-wild exploitation timeline.
CVE-2026-55255 is a CVSS 6.1 authorisation bypass (IDOR) in the Langflow AI-orchestration platform. Per Sysdig, a financially motivated operator chained it with a remote-code-execution flaw to steal other tenants\u2019 LLM provider API keys and AWS credentials. Sysdig frames AI orchestration platforms as a credential trove in their own right \u2014 a single compromised instance can leak the keys that pay for a competitor\u2019s inference and hosting bills. It is the AI-era equivalent of the same public-surface-RCE story: a new class of internet-facing platform that already holds enough sensitive material to be worth stealing on its own.
CALL IT DEV — Software, AI and dedicated tech teams — Casablanca | Madrid | Dubai — contact@callitdev.com — +212-537-373777