Skip to content

CISA Adds Three Known Exploited Vulnerabilities to Catalog

Chimera readability score 90 out of 100, Specialist reading level.

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
- CVE-2026-48908 JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability
- CVE-2026-55255 Langflow Authorization Bypass Through User-Controlled Key Vulnerability
- CVE-2026-56290 Joomlack Page Builder Improper Access Control Vulnerability
These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
This product is provided subject to this Notification and this Privacy & Use policy.

Sentinel — Human

Confidence

The text reads like a direct summary or official communication regarding security protocol updates, exhibiting the formal, directive tone of human-authored policy dissemination.

Signals Detected
low severity: Sentence length variance is natural; the text shifts between direct statements and policy exposition.
low severity: The flow from specific CVEs to the overarching directive (BOD 26-04) and then to general encouragement is logically structured, typical of official communication.
low severity: The text clearly delineates specific actions (adding CVEs), policy context (BOD 26-04), and procedural steps (submitting nominations) without resorting to generic aggregation.
medium severity: The reference to specific, future-looking CVEs (CVE-2026 series) suggests either highly precise internal knowledge or a fictionalized example setup common in documentation testing.
Human Indicators
Use of specific, complex regulatory language (BOD 26-04) and clear delineation between federal mandates and organizational encouragement suggests an authoritative, internal source rather than generalized AI synthesis.
The structure adheres strictly to typical government/security advisories.