CISA warns of actively exploited RCE flaws in Joomla extensions

CISA has added two maximum-severity vulnerabilities in popular Joomla extensions to its Known Exploited Vulnerabilities catalog after attackers began exploiting them for remote code execution.

CISA orders federal agencies to patch by July 13. The agency categorized both flaws as maximum priority under Binding Operational Directive 26-04. Federal agencies must apply available security updates or mitigations within three days of the catalog addition on July 10.

The directive requires action by today.

Arbitrary file uploads enable PHP execution in iCagenda. CVE-2026-48939 affects the iCagenda extension, an open-source tool for event registration, scheduling, and calendar creation. Attackers can upload arbitrary files, including PHP scripts, through the file attachment feature, leading to data theft, web shell installation, and full website compromise.

CISA describes it as an unrestricted upload of file with dangerous type vulnerability. The flaw carries a CVSS score of 10.0.

Balbooa Forms flaw also allows unauthenticated RCE. CVE-2026-56291 impacts the Balbooa Forms extension, a drag-and-drop form builder that supports file uploads for contact forms. The vulnerability permits upload of dangerous file types such as executables, resulting in remote code execution and complete site takeover.

This flaw also holds a CVSS score of 10.0. Both vulnerabilities were added to the KEV catalog following confirmed zero-day exploitation.

Exploitation began before patches were available. According to mySites.guru, automated attacks against iCagenda were observed just hours before version 4.0.8 shipped. The Balbooa Forms vulnerability was exploited as a zero-day since July 8, one day before the vendor released its fix.

iCagenda 4.0.8 and 3.9.15, released June 15-16, address CVE-2026-48939. Balbooa Forms 2.4.1, released July 9, fixes CVE-2026-56291.

Joomla site operators urged to review and update immediately. Administrators should check for the presence of either extension and apply the available patches or implement mitigations. SecurityWeek reports that all organizations, not just federal agencies, should review the KEV catalog entry and act to protect their assets.