CVE-2025-3248

The Cybersecurity and Infrastructure Security Agency (CISA) has mandated U.S. federal agencies to urgently patch CVE-2026-0770, a critical remote code execution vulnerability in the Langflow AI framework. This flaw allows unauthenticated attackers to execute code as root via improper handling of the exec_globals parameter in the validate endpoint. Exploitation has been observed in the wild since June 27, with attacks focused on command execution, reconnaissance, and attempts to exfiltrate AWS credentials and environment variables.

A new ransomware named ENCFORGE, attributed to the threat actor JADEPUFFER, is targeting AI model files through exploitation of a critical unauthenticated RCE vulnerability (CVE-2025-3248) in Langflow versions prior to 1.3.0. The attackers leverage the exposed Docker socket to escalate from container to host, deploying a custom-packed Go-based ransomware that encrypts AI-specific file types using AES-256-CTR and an embedded RSA-2048 public key. The ransomware avoids data exfiltration, instead relying solely on encryption, and leaves ransom notes with a Proton Mail contact reused from prior attacks, indicating campaign continuity.

The JadePuffer agentic threat actor has evolved to target AI/ML infrastructure using custom ransomware named EncForge, which encrypts critical AI assets such as model checkpoints, training datasets, and vector databases. The attack leverages autonomous decision-making to adapt in real time, deploying Python scripts to deliver the Go-based EncForge payload after gaining root access via an exposed Docker socket. The ransomware uses AES-256 and RSA-2048 encryption, appends '.locked' to encrypted files, and leaves a ransom note, though no data exfiltration was observed.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated federal agencies to urgently patch CVE-2026-55255, an authentication bypass vulnerability in the Langflow AI development platform. This flaw allows authenticated attackers to access other users' workflows by manipulating the /api/v1/responses endpoint with a victim's flow_id, enabling data theft and resource abuse. Exploitation in the wild has been observed since June 25, with attackers pursuing financial gain through compute resource hijacking and credential theft. CISA has also added related Langflow vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVE-2025-3248 and CVE-2026-33017, exploited by ransomware actors.

CISA has added four actively exploited vulnerabilities in Adobe ColdFusion, Joomla Page Builder, and Langflow to its Known Exploited Vulnerabilities (KEV) catalog. Exploitation of these flaws, including path traversal and improper access control, has been observed in the wild, leading to remote code execution and unauthorized access. Attackers have deployed web shells and targeted AI orchestration platforms to steal credentials, with activity linked to opportunistic, financially motivated campaigns. Federal agencies are urged to patch by July 10, 2026.

JadePuffer ransomware represents the first documented case of a ransomware operation fully automated by a large language model (LLM) agent. The AI-driven attack exploited CVE-2025-3248 in Langflow to gain initial access, then performed reconnaissance, credential theft, lateral movement, and encryption autonomously. The agent adapted to failures in real time, demonstrating human-like operational resilience and rapid iteration. It encrypted 1,342 Nacos configuration items and left a ransom note with a Proton Mail contact and a Bitcoin address, though the encryption likely used AES-128-ECB rather than AES-256 as claimed.

A new modular malware framework dubbed Avalon has been discovered, capable of executing a multi-stage attack chain that includes credential theft, lateral movement, and ransomware deployment via its CrownX component. The attack begins with a phishing email containing a password-protected archive hosted on Proton Drive, which delivers a malicious ISO image. The framework employs advanced defense evasion techniques, disables recovery mechanisms, and exfiltrates sensitive data before encrypting systems. Notably, Avalon shows signs of AI-assisted development, lowering the barrier for less sophisticated actors to deploy complex malware.