Week of July 6, 2026: CISA's Own Breach Lessons and Active ColdFusion, Langflow Exploits

Security leaders tracked CISA's own after-action report on an AWS GovCloud key exposure alongside active attacker exploitation of newly disclosed flaws in Adobe ColdFusion and the Langflow AI framework, both added to CISA's Known Exploited Vulnerabilities catalog. River Financial Corporation amended its SEC breach disclosure to confirm unauthorized network access and pending litigation, Accenture acknowledged a security incident tied to a claimed 35GB data theft, and researchers detailed an extortion campaign hijacking Microsoft 365 accounts through fake passkey enrollment prompts.

CISA Adds Actively Exploited Adobe ColdFusion Flaw to KEV Catalog

CISA added CVE-2026-48282, a critical Adobe ColdFusion path traversal vulnerability, to its Known Exploited Vulnerabilities catalog on July 7, 2026, citing evidence of active exploitation. The flaw lets remote, unauthenticated attackers achieve arbitrary code execution. Under Binding Operational Directive 26-04, CISA required federal civilian agencies to remediate the vulnerability on internet-facing assets that could grant attackers total control. CISA also reiterated that it will keep adding vulnerabilities meeting its criteria and encouraged all organizations to apply the same patch priority. (CISA)

Attackers Exploit Langflow IDOR Flaw to Harvest API Keys

Sysdig's Threat Research Team reported that a financially motivated operator was actively exploiting CVE-2026-55255, an insecure direct object reference flaw in the open-source Langflow AI workflow platform, to hijack other users' flows and extract embedded API keys, cloud credentials, and database secrets. CISA added the vulnerability, which affects Langflow versions prior to 1.9.2, to its Known Exploited Vulnerabilities catalog on July 7, 2026, and ordered federal civilian agencies to remediate it by July 10, 2026. The same actor paired the flaw with a previously known Langflow remote-code-execution bug. (Help Net Security)

CISA Publishes After-Action Report on Its Own Cloud Credential Exposure

On July 9, 2026, CISA's CIO and acting CISO published a public account of an internal incident response triggered after a reporter found CISA AWS GovCloud keys and other data in a public repository. The agency said the repository belonged to a contractor, that leaked credentials were not used outside CISA's environments, and that no customer or mission data was exposed. CISA rotated all credentials in the affected environments, limited the ability to upload to public repositories, and said it is refining incident-reporting channels after the response exposed several internal gaps. (CISA)

River Financial Discloses Possible Data Impact in Cybersecurity Incident

Alabama-based River Financial Corporation filed an amended Form 8-K on July 6, 2026, stating that its ongoing investigation found reason to believe certain data was potentially impacted, though the company had not yet determined whether personally identifiable information was affected. River said there was no evidence that customer accounts had been impacted and that the full nature, scope and impact of the incident remained undetermined. The bank holding company said it would file a further amendment once additional information became available. (SEC EDGAR)

River Financial Confirms Unauthorized Access, Faces Class Actions

In a further amendment filed July 10, 2026, River Financial Corporation said its investigation determined that an unauthorized threat actor had accessed portions of its network and removed certain data from its environment. The company said it was not aware of any reports of fraud tied to the incident, but noted that two class action lawsuits had been filed following public disclosure. River said the full nature, scope and impact of the incident had still not been determined as of the filing date. (SEC EDGAR)

Accenture Confirms Security Incident After Claimed 35GB Data Theft

Accenture acknowledged a security incident on July 8, 2026, after a threat actor using the handle 888 claimed on a cybercrime forum to have stolen just over 35GB of source code, RSA and SSH keys, Azure access tokens, and configuration files from the company in July 2026. Accenture told reporters it was aware of the isolated matter and had remediated its source, without confirming data exfiltration, and said operations and service delivery were not affected. The claim included a screenshot purportedly showing exfiltration from a private Azure DevOps repository. (Help Net Security)

Extortion Group Abuses Fake Passkey Enrollment to Hijack Microsoft 365 Accounts

Okta and Palo Alto Networks researchers described an active campaign, tied to the Pink extortion crew, in which attackers vished employees and directed them to spoofed Microsoft Entra login pages to steal credentials and multifactor codes, then enrolled an attacker-controlled passkey on the victim's account. Targets were shown a fake recovery-key confirmation screen with a cryptocurrency-style seed phrase as a distraction while the takeover completed. Okta said the campaign, observed across food and beverage, technology, healthcare, automotive, construction and aviation organizations, was aimed at data extortion. (Help Net Security)

Microsoft Patches RoguePlanet Windows Defender Privilege Escalation Flaw

Microsoft released a security update for the Microsoft Malware Protection Engine fixing CVE-2026-50656, a Windows Defender local privilege escalation vulnerability tied to the publicly disclosed RoguePlanet exploit, affecting Windows 10 and Windows 11. Microsoft said the flaw was not yet exploited but was likely to be targeted, after a researcher using the handle Nightmare Eclipse published proof-of-concept code in June 2026. Help Net Security reported on July 9, 2026 that the fixed engine version, 1.1.26060.3008, updates automatically for most users, though Microsoft advised admins who disabled automatic updates to trigger the patch manually. (Help Net Security)