VulnerabilityBleeping Computer
9.8 — CRITICAL
CISA warns of actively exploited RCE flaws in Joomla extensions
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are exploiting vulnerabilities in the iCagenda and Balbooa Forms extensions for Joomla to achieve remote code execution through arbitrary file uploads. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
CISA has warned of actively exploited Remote Code Execution (RCE) flaws in Joomla extensions iCagenda and Balbooa Forms, which can lead to data theft, web shell installation, and full website compromise. The vulnerabilities were categorized as maximum priority, with a deadline for federal agencies to apply available security updates within three days.
⚙️Technical Details
CVEs
CVE-2026-48939CVE-2026-56291
Affected Systems
Joomla sites using iCagenda and Balbooa Forms extensions
Attack Vectors
NETWORK
💥Impact Assessment
Severity: CRITICAL
🛡️Recommended Actions
1Check for the presence of iCagenda and Balbooa Forms on your Joomla site
2Apply available security updates and/or mitigations within three days
3Disable arbitrary file uploads in the file attachment feature
📦Affected Products
Joomlic IcagendaBalbooa FormsiCagenda
🔐NVD Verified DataVERIFIED
CVE-2026-48939 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-434
Affected Products (CPE)
Joomlic Icagenda
CVE-2026-56291 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-434
Affected Products (CPE)
Balbooa Forms
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.