Roundcube, ColdFusion, SharePoint and other enterprise web stacks are under active exploitation

A major cluster of articles shows attackers moving quickly on high-value web application flaws, with CISA repeatedly adding exploited issues to its KEV catalog. Roundcube mail servers, Adobe ColdFusion, SharePoint, Joomla extensions, Gitea, and other web-facing stacks all appear in the stream as either actively exploited or rapidly weaponized after disclosure. The common thread is that public-facing business applications are being targeted almost immediately after technical details or proof-of-concepts appear. That means exposure is not limited to internet-facing application owners; downstream services, partner portals, and customer-facing workflows inherit the risk as well. For organizations in finance and government, especially in the Italian and Swiss orbit, email and collaboration platforms are particularly sensitive because they sit near identity, documents, and operational records. The volume of these stories also shows that patch confidence is weakening: teams need validation of whether a fix has actually been deployed and whether the service is still reachable from the internet. This is a recurring operational risk rather than a one-off vulnerability event.

Sources

• Attackers exploit critical Adobe ColdFusion vulnerability (CVE-2026-48282) — Help Net Security
• Critical Gitea flaw under active exploitation exposes repositories and secrets — Security Affairs
• U.S. CISA adds iCagenda and Balbooa Forms flaws to its Known Exploited Vulnerabilities catalog — Security Affairs