CISA orders urgent patching of actively exploited Langflow RCE flaw

🚨 ACTIVE EXPLOITATION

• CISA orders urgent patching of actively exploited Langflow RCE flaw CVE-2026-0770 — bleepingcomputer.com
  CISA mandates immediate patching of an actively exploited Langflow remote code execution vulnerability.
  • Applies to Langflow visual framework users, including U.S. federal agencies
  • Vulnerability CVE-2026-0770 allows unauthenticated remote code execution as root via exec_globals parameter
  • Exploitation observed since June 27 with over 220 attempts from 64 IPs targeting /api/v1/validate/code endpoint
  • Attackers attempt command execution, system reconnaissance, malware deployment, and AWS credential theft
  • CISA added CVE-2026-0770 to Known Exploited Vulnerabilities catalog and ordered patching by July 24, 2026

🕵️ RESEARCH & DEEP DIVES

• Two command injection flaws found in Ansible Lightspeed VS Code extension (CVE-2026-44189, CVE-2026-44190) — cve.threatint.com
  Ansible Lightspeed VS Code extension contains two command injection vulnerabilities allowing remote code execution.

  • CVE-2026-44189: Malicious playbook filenames with special characters allow arbitrary code execution
  • CVE-2026-44190: Improper validation of ansible.python.activationScript setting enables command injection
  • Both flaws allow attackers to execute commands with the privileges of the VS Code user
  • Discovered by Laura Pardo of Red Hat; publicly disclosed July 22, 2026

• n8n before 1.123.64 vulnerable to remote code execution via Git clone TOCTOU flaw — cve.threatint.com
  n8n before 1.123.64 allows authenticated users to execute remote code via a Git clone race condition.

  • Vulnerability is a time-of-check to time-of-use (TOCTOU) race condition in the Git node clone operation
  • Authenticated users can bypass path restrictions by swapping a directory for a symlink after validation
  • Attack enables planting a crafted repository loaded as a custom node on restart, executing arbitrary JavaScript
  • Both self-hosted and cloud instances of n8n are affected

⚠️ LESSER-KNOWN / UNDER-REPORTED

• Adobe Acrobat Chrome extension flaw exposed private WhatsApp Web chats — bleepingcomputer.com
  A flaw in Adobe Acrobat Chrome extension allowed access to private WhatsApp Web chats.
  • Applies to Adobe Acrobat Chrome extension versions 26.5.2.1 and below
  • Vulnerability lets any website access WhatsApp Web conversations without authentication
  • Attack exploits extension's internal messaging and DOM manipulation via a predictable tab ID
  • No session cookies needed; attacker can steal chat lists, contact names, messages, and profiles
  • Fixed in version 26.5.2.3 with patch delivered automatically to users