CISA Flags Two Exploited Joomla Vulnerabilities

Two Joomla extensions are under active zero-day exploitation, according to reports gathered by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), which has added both maximum-severity flaws to its Known Exploited Vulnerabilities (KEV) catalog. The flaws affect the iCagenda and Balbooa Forms extensions for Joomla, an open-source content management system used to build websites, and each carries a CVSS severity score of 10.0, the highest possible rating. CVSS stands for Common Vulnerability Scoring System, a standard used to rate how severe a security issue is.

CVE-2026-48939 affects the iCagenda extension. The problem is in the component's 'Submit an Event' form, which lets visitors propose calendar events. Because the file attachment feature does not properly limit what can be uploaded, an attacker can send a file containing PHP, a programming language commonly used for website pages, and then run that code on the server. mySites.guru, a cloud-based dashboard service for WordPress and Joomla websites, reports that this vulnerability has been exploited as a zero-day, meaning before a fix existed, since June 15, 2026, in automated attacks aimed at Joomla sites where iCagenda is installed. According to mySites.guru, its team first saw the activity in a client's access log when an automated scanner identifying itself as 'icagenda-batch/1.0' grabbed a token, posted a malicious upload to the submit endpoint, then fetched the planted shell from the exact folder where the component writes attachments. Affected versions include iCagenda 4.x up to and including 4.0.7, and legacy 3.x versions from 3.2.1 up to and including 3.9.14. The developer, JoomliC, has released iCagenda 4.0.8 and 3.9.15 to correct the issue. Site owners are advised to check the 'images/icagenda/frontend/attachments/' folder for suspicious PHP files and remove them.

CVE-2026-56291 affects Balbooa Forms, another Joomla extension used to create forms. mySites.guru discovered this vulnerability on July 8, 2026, after a live attack against one of its customers. Up to and including version 2.4.0, the extension's frontend attachment upload accepted a file from any anonymous visitor with no login, no CSRF token, a secret value that confirms a request is legitimate, and no check on the file type. An attacker could upload a PHP file into a public folder and then run it, which is unauthenticated remote code execution, meaning a way to take control of the server without a password. The issue is patched in Balbooa Forms version 2.4.1. mySites.guru has shared indicators of compromise for site owners: check the Balbooa Forms upload folder, by default 'images/baforms/uploads', for any file that is not an image or document and especially for anything ending in PHP; check the Joomla user list for suspicious administrator accounts; and audit the site for recently modified or unfamiliar PHP files.

In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies have until July 13, 2026, to apply the fixes in their networks. The disclosure comes as the Australian Cyber Security Centre (ACSC) issued an alert about a global exploitation campaign targeting content management systems (CMS) and plugins. The ACSC said malicious actors are actively scanning websites for ways to deploy web shells, small malicious files that give attackers remote access and control of a server, by exploiting vulnerabilities that primarily allow unauthenticated file upload, remote code execution, server-side request forgery, which tricks a server into making unintended requests, or deserialization, the unsafe process of turning stored data back into running code. The alert lists several identified vulnerabilities, including Sneeit Framework (CVE-2025-6389), WPBookit (CVE-2025-7852), Gravity Forms (CVE-2025-12352), Craft CMS (CVE-2025-32432), Ninja Forms (CVE-2026-0740), MaxSite CMS (CVE-2026-3395), Breeze Cache (CVE-2026-3844), WavePlayer (CVE-2025-12057), MetInfo CMS (CVE-2026-29014), and Joomla JCE (CVE-2026-48907). ACSC said this highly scaled global exploitation campaign shows quickly changing cyber risk, and that advances in artificial intelligence are accelerating the speed and scale of cyber operations and reducing the time between vulnerability disclosure and exploitation.

For website owners and IT teams, these notices are a reminder that Joomla and WordPress plugins are a common entry point, especially outdated or unused extensions. Since the two Joomla flaws are already being exploited, updating iCagenda to 4.0.8 or 3.9.15 and Balbooa Forms to 2.4.1 is urgent. After updating, delete any unexpected PHP files from the upload folders and review administrator accounts. The ACSC alert also shows that attackers are scanning broadly for web shells across many CMS plugins, so keeping every plugin current and removing unneeded ones reduces exposure. For WordPress site owners, a managed hosting service such as AEU Hosting, which provides managed WordPress hosting secured end to end, can take on platform-level updates and security hardening, while individual plugin updates and Joomla-specific fixes still need attention from the site owner.