So, What's Breaking in Mobile Security?

Five developments this week point to the same operational problem: AI workflow builders, remote access tools, and legacy web frameworks were often introduced outside the formal security process, but they now carry the same remediation deadlines as core infrastructure.

Signal 1 — Langflow Is Now a Liability Line Item

Langflow, the open-source AI workflow builder, landed on the CISA Known Exploited Vulnerabilities catalog this week. CVE-2026-55255 is an authorization bypass that lets an authenticated attacker run another user's workflow by providing that user's flow ID. If you're using the affected version, the remediation deadline is July 10.

The mobile frame: Langflow deployments are increasingly serving as orchestration layers for mobile app backends and AI-assisted identity workflows. If your organization is running Langflow to automate anything touching user data or authentication, that instance is now on a federal remediation clock regardless of whether it was deployed by IT or a product team.

Action: Identify every Langflow instance in your environment — including those deployed outside traditional IT governance. Confirm the patch status before Friday. If instances are unpatched and internet-reachable, treat as actively exploited.

Signal 2 — SimpleHelp's Authentication Bypass Reaches MFA

CVE-2026-48558 in SimpleHelp is an OIDC authentication bypass: identity tokens submitted during login are accepted without verifying their cryptographic signatures. In vulnerable configurations, an unauthenticated attacker can forge a token with arbitrary identity claims and obtain a full technician session. In some configurations this also bypasses multi-factor authentication entirely.

The mobile frame: Remote support tools give attackers a direct path into the identity layer across both managed and unmanaged mobile devices. Once forged credentials are accepted, the session inherits the technician's legitimate privileges, including the ability to initiate remote access on enrolled endpoints. On the TBI axis, the compromise crosses both Transport and Identity because the attacker controls the connection and the authority used to act through it.

Action: Check your SimpleHelp version against the vendor advisory. If OIDC authentication is configured, assume bypass is possible until patched. Audit recent technician session logs for anomalous session origination.

Signal 3 — ColdFusion Is Still Running Somewhere in Your Stack

Adobe ColdFusion received a path traversal vulnerability this week (CVE-2026-48282) that leads to arbitrary code execution. CISA added it with a July 10 due date.

The mobile frame: ColdFusion instances often persist in enterprise stacks as backend services for mobile applications built in earlier development cycles — sometimes without current ownership or patching responsibility. If your mobile app calls any ColdFusion endpoint, that backend is now the vulnerability. Verification Latency is high: organizations frequently don't know ColdFusion is running until a CVE makes them look.

Action: Run an asset inventory query specifically for ColdFusion. Check load balancer configs, API gateway routes, and mobile app network traffic logs for ColdFusion endpoints. Patch or isolate immediately.

Signal 4 — SharePoint Deserialization Closes the Enterprise Collaboration Gap

Microsoft SharePoint Server (CVE-2026-45659) contains a deserialization of untrusted data vulnerability allowing an authorized attacker to execute code over the network. The due date was July 4 — it's already past.

The mobile frame: SharePoint is a common sync target for mobile device management configurations, file access policies, and enterprise mobile apps. A compromised SharePoint instance can serve as a persistence point for credential harvesting affecting the same users whose mobile devices are enrolled in your MDM. The Pocket Attack Surface expands when SharePoint and mobile are in the same identity federation.

Action: If SharePoint Server is in scope and unpatched, escalate now — the CISA deadline has already passed. Confirm patch status against Microsoft's update guide. Audit connected mobile app integrations for exposure.

Signal 5 — The Pattern Is the Signal

Langflow, SimpleHelp, ColdFusion, and SharePoint entered production through four different parts of the organization. A product team deployed Langflow. IT support brought in SimpleHelp. ColdFusion may be owned by a team that no longer exists. SharePoint has been part of enterprise IT for years. They now appear in the same catalog with the same remediation clock, even though no single team may have visibility across all four.

The CISA KEV catalog doesn't care about procurement process or deployment channel. When a tool enters the catalog, every organization running it — regardless of how it got there — gets the same remediation deadline. Shadow IT and formally governed IT are on identical clocks.

The mobile frame: Mobile devices routinely interact with all four of these tool categories through enterprise apps, remote support sessions, content sync, and AI-assisted workflows. The Pocket Attack Surface is not limited to the device itself — it extends to every backend service the device touches.

My Take

Most organizations can tell you who owns the firewall. Fewer can tell you who still owns the workflow builder a product team deployed, the remote support platform IT brought in, or the ColdFusion server inherited from a team that no longer exists.

That is the risk underneath this week's KEV additions. These systems did not enter production through one security program, but once they are actively exploited, they land on the same remediation clock. The deadline does not care whether the asset is in the CMDB, whether the original owner is still employed, or whether security knew it was exposed.

The programs that handle this well do more than circulate a CVE list. They can connect an exploited product to a current owner, an exposed instance, the identities that administer it, and the endpoints or workflows it can reach. When one of those links is missing, patching slows down because the organization first has to reconstruct how the system got there.

I would use this week's list as an ownership test. Pick each affected product and ask who can authorize the fix today, who can prove it was completed, and what breaks if that person cannot be found. Any answer that depends on institutional memory is already a control gap.

— William

One action this week: Pull your asset inventory and ask which of these four categories contains instances you don't currently have a patch owner for. That list is your actual exposure.

Mobile Security Guru publishes every Friday. Five signals. One action. Built for security leaders who carry the risk.