Critical CVSS 10.0 Vulnerabilities in Joomla SP Page Builder and Page Builder CK Enable One-Click Unauthenticated File Upload and Full Site Takeover
U.S. cybersecurity authorities have issued an urgent alert regarding three actively exploited vulnerabilities affecting Joomla extensions and the Langflow AI development platform. The Cybersecurity and Infrastructure Security Agency (CISA) has added the flaws to its Known Exploited Vulnerabilities (KEV) catalog and strongly recommends that organizations apply patches without delay.
The first vulnerability, CVE-2026-48908 (CVSS 10.0 Critical), resides in the SP Page Builder extension for Joomla. It allows an unauthenticated attacker to upload arbitrary files, including malicious PHP code, to the server and subsequently execute them, resulting in full control over the affected website.
The second issue, CVE-2026-55255 (CVSS 9.9 Critical), affects the Langflow platform used to build AI-powered applications. Due to improper authorization checks, an authenticated attacker can specify another user’s process identifier and execute it under that user’s privileges, potentially exposing confidential data, cryptographic keys, and other secrets stored within the system.
The third vulnerability, CVE-2026-56290 (CVSS 10.0 Critical), was discovered in the Page Builder CK extension for Joomla. Insufficient access controls enable unauthenticated attackers to upload and execute arbitrary code on the server, again granting complete site takeover capabilities.
All three vulnerabilities are already being leveraged in real-world attacks. Although CISA has not disclosed details about the threat actors, their targets, or the number of compromised systems, such flaws are frequently used as initial access vectors, especially when internet-facing websites and services are involved.
Federal civilian agencies are required to remediate these issues promptly under Binding Operational Directive (BOD) 26-04, which mandates rapid patching of KEV-listed vulnerabilities that affect publicly accessible resources and enable full system compromise. Agencies must also verify whether attackers have already gained access to their infrastructure before applying updates.
While the directive applies only to U.S. federal agencies, CISA recommends that all organizations adopt the same approach: identify vulnerable Joomla extensions and Langflow instances, deploy available patches, and thoroughly review system logs for signs of prior compromise.
Related articles
Dangerous C++ Traps: Memory Safety Issues, Undefined Behavior, and Code That Betrays Developers
Around 70% of vulnerabilities assigned CVE numbers by Microsoft each year stem from memory safety errors, with Chromium reporting a similar pattern for serious Chrome bugs. The article examines how C++ deliberately permits low-level memory access for performance but demands strict discipline to avoid undefined behavior (UB). It details real-world cases including Heartbleed (CVE-2014-0160) in OpenSSL, use-after-free errors, buffer overflows, and data races. Modern tools such as AddressSanitizer, UndefinedBehaviorSanitizer, and ThreadSanitizer are presented as essential for detection, alongside recommendations for RAII, std::span, and smart pointers. The piece also discusses C++26 changes introducing erroneous behavior for uninitialized variables and advises when to consider memory-safe languages like Rust for new components. Practical migration steps and compiler warning strategies are outlined to reduce risk in existing codebases.
Critical CosmosEscape Flaw Breaks Customer Isolation in Azure Cosmos DB
A critical vulnerability named CosmosEscape allowed attackers to escape the restricted Gremlin API environment and execute arbitrary code on the DB Gateway component of Azure Cosmos DB. The flaw exploited weaknesses in .NET reflection protections, enabling file read/write operations and command execution that ultimately yielded the Cosmos Master Key. With this global signing key, an attacker could retrieve the primary key for any customer account and gain full read/write access. The exploit also exposed the Config Store containing account names, subscription identifiers, tenant details, and network rules. Even network-isolated and private instances remained vulnerable because the DB Gateway itself enforced those restrictions. Internal Microsoft services including Entra ID, Teams, and Copilot rely on Cosmos DB, amplifying the potential impact of the issue.
Critical RCE Vulnerability CVE-2026-66066 Affects Ruby on Rails Active Storage with libvips
A severe vulnerability tracked as CVE-2026-66066 has been identified in the Ruby on Rails web application framework. The flaw, also referred to as KindaRails2Shell by researchers, impacts applications that use Active Storage with the libvips image processing engine. Attackers can exploit the issue by uploading specially crafted files to read arbitrary files without authentication. This exposure may lead to theft of environment variables, secret keys, and external service credentials, enabling remote code execution or further attacks. The vulnerability stems from unsafe operations in the dependent libvips library. It carries a CVSS v4.0 base score of 9.5 and is rated Critical. JPCERT/CC has issued an advisory urging immediate updates.
Critical Vulnerabilities Disclosed in Adobe Campaign Classic Require Immediate Patching
Adobe has released a security advisory detailing two high-risk vulnerabilities affecting Adobe Campaign Classic on-premises deployments on Windows and Linux. CVE-2026-48449 is an improper authorization flaw that permits remote attackers to execute arbitrary code without authentication and carries a maximum CVSSv3.1 base score of 10.0. CVE-2026-48448 is a SQL injection vulnerability that allows unauthenticated attackers to read arbitrary files from the file system, rated at 8.6. Both issues affect the campaign management platform used by organizations for marketing automation. Adobe urges administrators to apply the available security updates without delay due to the elevated risk of exploitation.