Exploited This Week: SharePoint, ColdFusion & Langflow

I like doing one of these round-ups because it keeps me honest about what's actually being hit versus what's just scary on paper. This week gave us a clean spread: a classic enterprise server, a decades-old web platform, and, interestingly, an AI workflow tool. Different worlds, same story, all three are being exploited now and all three are on CISA's Known Exploited Vulnerabilities (KEV) list, which is basically the government saying "this is confirmed live, stop reading and patch".

Here's the shortlist before I take each one apart. Everything below comes from the vendor advisories, NVD and CISA, not my guesswork.

1. Adobe ColdFusion, CVE-2026-48282 (CVSS 10.0)

CVSS 10.0 · CRITICAL

This one is a perfect-10 path traversal in ColdFusion's Remote Development Services (RDS), the feature that lets an IDE talk to the server. The RDS file handler at /CFIDE/main/ide.cfm?ACTION=FILEIO doesn't properly check the path you ask for, so an attacker can walk out of the intended folder and write a file anywhere on disk. Write a file to the right place on a web server and you've got code execution, game over. Why it's a 10: when RDS authentication is turned off (a common default in older setups), no login is needed at all.

This is the one that scares me most of the three, and not just for the score. Reports say attackers were hitting it within a couple of hours of the details going public, which tells you people were sitting ready. It affects ColdFusion 2025.9, 2023.20 and earlier, and the fix is ColdFusion 2023 Update 21 or 2025 Update 10.

2. Langflow, CVE-2026-55255 (CVSS 9.9)

CVSS 9.9 · CRITICAL

This is an authorisation bypass in Langflow, an open-source tool for building and running AI agents and workflows (it calls each workflow a "flow"). When the app looks up a flow by its UUID (a long unique id), it fetches it from the database without ever checking that the flow belongs to you. So any logged-in user who knows, or guesses, another user's flow id can run that flow. This bug class has a name: IDOR (Insecure Direct Object Reference), where the app trusts an id you control as if it proves ownership. Flows often hold API keys and process sensitive data, so running someone else's flow can mean harvesting their credentials, which is exactly what defenders have seen in the wild.

What makes this one interesting to me is that its CVSS (9.9) is high, but the real reason it's dangerous is how trivial it is, there's no clever exploit chain, just a missing ownership check. It affects Langflow before 1.9.1; the fix is 1.9.1 or later. First in-the-wild exploitation was flagged by the Sysdig research team, and it's already being used for credential theft.

3. Microsoft SharePoint Server, CVE-2026-45659 (CVSS 8.8)

CVSS 8.8 · HIGH

This is a remote code execution bug in on-premises SharePoint Server, caused by deserialization of untrusted data. Deserialization is when an app rebuilds an object from incoming data, and if it blindly trusts that data, an attacker can smuggle in something that runs code as it's rebuilt. Microsoft says any authenticated user with the low-level "Site Member" permission can trigger it, no admin rights needed, which is a low bar in a big org where lots of people have a SharePoint login. And on-prem SharePoint sits in the middle of corporate networks, which makes it a launchpad for ransomware crews.

Worth being precise here, because there's nuance. Microsoft originally rated this "Exploitation Less Likely" and patched it back in May 2026. CISA has now confirmed real exploitation and added it to KEV, but the exact method and who's behind it aren't public yet. For context, not attribution, on-prem SharePoint has been a favourite target of the Storm-2603 crew (linked to Warlock ransomware), and Microsoft recently documented messy intrusions where multiple actors piled into the same SharePoint-adjacent network. Affected: SharePoint Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.

Am I exposed? A 60-second triage

Before anything else, work out if you even run these. Three quick, read-only checks, one per product. These just tell you your version, they don't touch anything:

MITRE ATT&CK mapping

Where these sit if you're building detections. All three start the same way:

• T1190 · Exploit Public-Facing Application, the initial access for all three.
• T1505.003 · Web Shell, the likely follow-on for the ColdFusion file write and SharePoint RCE.
• T1078 · Valid Accounts, since SharePoint and Langflow both abuse an authenticated session.
• T1552 · Unsecured Credentials, the observed goal of the Langflow attacks (harvesting keys from flows).

The pattern worth remembering

Line these three up and there's a lesson underneath. Two of them (ColdFusion, Langflow) are things that quietly ended up reachable from the internet when they should never have been. The third (SharePoint) was patched months ago and is still getting people because the update never got applied. None of this needed a genius exploit. That's the uncomfortable bit: the stuff that actually bites is rarely the clever zero-day, it's an exposed admin service and a patch that sat in a backlog. Attack surface plus patch lag is the whole game. Take these three off the internet and patch them, and this week's headlines don't touch you.

The one that stuck with me

The one that stuck with me is Langflow, because it's a sign of where things are going. As teams bolt AI tooling into their stacks, that tooling becomes attack surface like anything else, and a missing ownership check is a missing ownership check whether it's a banking app or an AI workflow builder. I'll admit I hadn't clocked Langflow as a target until this landed, so it's a good reminder to me that "new and shiny" and "internet-exposed" is a rough combination. If you defend any of these three, I'd genuinely like to hear what your detections caught. Which one should I pull into a proper deep-dive next?

If this brief was useful, come say hi on LinkedIn or the contact page. I try to do these when a week actually earns it.

References

• CISA: Known Exploited Vulnerabilities Catalog
• NVD: CVE-2026-48282 (Adobe ColdFusion)
• Adobe Security Bulletin APSB26-68 (ColdFusion)
• NVD: CVE-2026-55255 (Langflow)
• The Hacker News: SharePoint CVE-2026-45659 added to KEV

FAQ

Which CVEs are being actively exploited this week?

Three were added to CISA's Known Exploited Vulnerabilities catalog: CVE-2026-45659 (Microsoft SharePoint Server RCE), CVE-2026-48282 (Adobe ColdFusion path traversal, CVSS 10.0), and CVE-2026-55255 (Langflow authorization bypass, CVSS 9.9). All three have confirmed in-the-wild exploitation.

How serious is the Adobe ColdFusion flaw CVE-2026-48282?

Very. It is a CVSS 10.0 path traversal in the RDS FILEIO handler that allows arbitrary file write and full remote code execution, with no authentication needed when RDS auth is disabled. Reports say it was exploited within hours of disclosure. Patch to ColdFusion 2023 Update 21 or 2025 Update 10.

What should defenders do first?

Check whether you run SharePoint on-prem, Adobe ColdFusion, or Langflow, and patch those to the fixed versions immediately, as all three are on CISA KEV. Take ColdFusion RDS and Langflow off the internet entirely, and hunt for the detection signals listed for each.

Related reading

• CVE-2026-8451: NetScaler CitrixBleed (another edge-device brief)
• Injection Attacks Explained (untrusted input, the root of the ColdFusion bug)
• AI, ML & Deep Learning explained (context for the Langflow AI tooling)
• Browse all Threats & Exploits briefs