Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

CISA flags critical Joomla JCE bug enabling remote code execution

Part of the CVE-2026-48907 story · since 16 Jun

Quiet for 20 weekslast report 17 Jun6 articles4 outlets
16 Jun · CISA first3 Aug27 Aug20 SepNowThis article6th of 6
  • Tue 16 Jun, 20:50 UTC. CISA, first report. CISA adds critical Joomla editor flaw CVE-2026-48907 to KEV. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 21:37 UTC. CISA. CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited List. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:21 UTC. SecurityOnline, its first report on the story. WooCommerce stores hit by payment skimmer (CVE-2026-48907). Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:50 UTC. SecurityWeek, its first report on the story. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 08:25 UTC. SecurityOnline. AdGuard blocks Joomla exploit and launches email tracking shield. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 15:40 UTC. Security Affairs, its first report on the story. CISA flags critical Joomla JCE bug enabling remote code execution. Cites a CVE in CISA KEV. This article, 6th of 6.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical flaw in the Widget Factory Joomla Content Editor (JCE), identified as CVE-2026-48907 with a CVSS score of 10.0, to its Known Exploited Vulnerabilities catalog. This vulnerability allows unauthenticated users to create new editor profiles, leading to PHP code uploads and execution. It affects JCE versions 1.0.0 through 2.9.99.4 and was patched in version 2.9.99.5 released on June 3, 2026.

Federal agencies must address this vulnerability by June 19, 2026, to protect their networks, and private organizations are also advised to review and mitigate this threat.

How the story developed

All 6 articles
Quiet for 20 weekslast report 17 Jun6 articles4 outlets

6 articles from 4 outlets since 16 Jun. Quiet since 17 Jun. This was the 6th report, 19 hours after the first.

Now16 Jun1718191 NovFirst reportCISA · 16 Jun, 20:50This article6th of 6 · day 1
  • Tue 16 Jun, 20:50 UTC. CISA, first report. CISA adds critical Joomla editor flaw CVE-2026-48907 to KEV. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 21:37 UTC. CISA. CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited List. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:21 UTC. SecurityOnline, its first report on the story. WooCommerce stores hit by payment skimmer (CVE-2026-48907). Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:50 UTC. SecurityWeek, its first report on the story. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 08:25 UTC. SecurityOnline. AdGuard blocks Joomla exploit and launches email tracking shield. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 15:40 UTC. Security Affairs, its first report on the story. CISA flags critical Joomla JCE bug enabling remote code execution. Cites a CVE in CISA KEV. This article, 6th of 6.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 6 articles as a list
  1. Tue 16 JunDay 02
    1. CISA adds critical Joomla editor flaw CVE-2026-48907 to KEV20:50 · CISA · official · First report · CISA alert · Known exploited CVE
    2. CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited List21:37 · CISA · official · Known exploited CVE
  2. Wed 17 JunDay 14
    1. WooCommerce stores hit by payment skimmer (CVE-2026-48907)07:21 · SecurityOnline · Known exploited CVE
    2. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root07:50 · SecurityWeek · Known exploited CVE
    3. AdGuard blocks Joomla exploit and launches email tracking shield08:25 · SecurityOnline · Known exploited CVE
    4. CISA flags critical Joomla JCE bug enabling remote code execution15:40 · Security Affairs · Known exploited CVE · This article, 6th of 6

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in