Critical CVSS 10.0 Vulnerabilities in Joomla SP Page Builder and Page Builder CK Enable One-Click Unauthenticated File Upload and Full Site Takeover
U.S. cybersecurity authorities have issued an urgent alert regarding three actively exploited vulnerabilities affecting Joomla extensions and the Langflow AI development platform. The Cybersecurity and Infrastructure Security Agency (CISA) has added the flaws to its Known Exploited Vulnerabilities (KEV) catalog and strongly recommends that organizations apply patches without delay.
The first vulnerability, CVE-2026-48908 (CVSS 10.0 Critical), resides in the SP Page Builder extension for Joomla. It allows an unauthenticated attacker to upload arbitrary files, including malicious PHP code, to the server and subsequently execute them, resulting in full control over the affected website.
The second issue, CVE-2026-55255 (CVSS 9.9 Critical), affects the Langflow platform used to build AI-powered applications. Due to improper authorization checks, an authenticated attacker can specify another user’s process identifier and execute it under that user’s privileges, potentially exposing confidential data, cryptographic keys, and other secrets stored within the system.
The third vulnerability, CVE-2026-56290 (CVSS 10.0 Critical), was discovered in the Page Builder CK extension for Joomla. Insufficient access controls enable unauthenticated attackers to upload and execute arbitrary code on the server, again granting complete site takeover capabilities.
All three vulnerabilities are already being leveraged in real-world attacks. Although CISA has not disclosed details about the threat actors, their targets, or the number of compromised systems, such flaws are frequently used as initial access vectors, especially when internet-facing websites and services are involved.
Federal civilian agencies are required to remediate these issues promptly under Binding Operational Directive (BOD) 26-04, which mandates rapid patching of KEV-listed vulnerabilities that affect publicly accessible resources and enable full system compromise. Agencies must also verify whether attackers have already gained access to their infrastructure before applying updates.
While the directive applies only to U.S. federal agencies, CISA recommends that all organizations adopt the same approach: identify vulnerable Joomla extensions and Langflow instances, deploy available patches, and thoroughly review system logs for signs of prior compromise.
Related articles
Six Months After tun0 Leak: Which Android VPN Clients Fixed Server Address Exposure and Which Ignored It
A detailed investigation reveals that Android VPN clients suffer from two distinct server address leaks when split tunneling is enabled. The first leak, tied to an unprotected local SOCKS proxy on 127.0.0.1, was quickly mitigated by most Xray and sing-box based clients through random ports and passwords. The second, more persistent leak allows excluded applications to bind sockets directly to the tun0 interface and discover the VPN server IP without root or special permissions. Only TeapodStream and OlConnect implemented owner-UID checks using ConnectivityManager.getConnectionOwnerUid, yet both initially mishandled the INVALID_UID response returned for excluded apps. AmneziaVPN has unmerged pull requests that correctly reject unknown owners, while sing-box offers a manual package_name_regex rule. v2rayNG closed the report as not planned, and major clients including WireGuard for Android, Mullvad, Proton VPN and others have issued no statements.
Part 2: How Third-Party Developers Closed the tun0 Leak in AmneziaVPN on Android
Third-party contributors to AmneziaVPN have detailed their fix for a VPN tunnel bypass affecting excluded applications on Android. The vulnerability allows any app, even those disallowed from the VPN, to bind sockets directly to the tun0 interface using SO_BINDTODEVICE and thereby discover the VPN server address. The team implemented a packet filter inside the client that queries Android via ConnectivityManager.getConnectionOwnerUid to determine packet ownership and drops traffic from unknown UIDs. The solution was integrated into both the Xray and AmneziaWG traffic paths, with the AmneziaWG hook placed inside amneziawg-go after packet parsing. Testing with leak_probe.py showed zero successful bypass attempts out of six methods when the filter was active, compared to six out of six without it. The developers submitted three pull requests and released a side-loaded test build, while noting remaining limitations such as raw sockets and tethering scenarios.
Cisco Confirms Active Exploitation of CVE-2026-76504 in Catalyst SD-WAN Manager
Cisco has confirmed that the critical vulnerability CVE-2026-76504 in Catalyst SD-WAN Manager has been exploited in attacks throughout September. The flaw carries a CVSS score of 9.8 and allows attackers to gain full administrator access without any credentials by bypassing API authentication through malformed URI encoding. The issue affects the login session handling mechanism, enabling forged requests to grant netadmin privileges by default. Similar URI manipulation techniques were observed earlier this month in Oracle PeopleSoft attacks. Patches are available across multiple release trains including 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1, while older installations must migrate to supported versions. Cisco recommends restricting access to trusted hosts and placing the Manager behind firewalls until updates are applied. The vulnerability was discovered during routine support operations and verified by Cisco's Product Security Incident Response Team.
Zero-Days in PaperCut MF Chained to Compromise Active Directory in Education Sector
Analysts at eSentire investigated an attack that chained two zero-days in PaperCut MF, tracked as CVE-2026-81578 and CVE-2026-82078, to move from an internet-exposed print server to a domain controller in an education sector client in under two days. Attackers gained initial access through the card or badge query field, delivering malicious Java code that allowed unauthenticated configuration changes and arbitrary bytecode execution on version 24.0.2. The first stage loader reassembled payload fragments in memory, launched the next stage, and deleted its own files while remaining compatible with multiple Tomcat versions. A web shell followed, accepting commands via a custom HTTP header, reading configurations, and erasing log traces while positioning itself early in the request processing chain. The command-and-control implant was AdaptixC2, hidden inside a modified Microsoft Copilot binary downloaded from Alibaba Cloud infrastructure. Privilege escalation was achieved without passwords by locating a domain-privileged service account, stealing its access token, and relaunching the implant under those rights. On the domain controller the payload arrived via administrative share and was executed by modifying the Windows PlugPlay service, after which the legitimate path was restored to minimize traces. The operators extracted credentials from memory and registry, enabled Restricted Admin mode, used an NTLM hash for RDP access, and copied the full Active Directory database containing passwords for all domain accounts.