Skip to content
OriginalSign in

CISA

CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited List

Part of the CVE-2026-48907 story · since 16 Jun

Quiet for 19 weekslast report 17 Jun6 articles4 outlets
16 Jun · CISA first1 Aug24 Aug16 Sep9 OctNowThis article2nd of 6
  • Tue 16 Jun, 20:50 UTC. CISA, first report. CISA adds critical Joomla editor flaw CVE-2026-48907 to KEV. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 21:37 UTC. CISA. CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited List. Cites a CVE in CISA KEV. This article, 2nd of 6.
  • Wed 17 Jun, 07:21 UTC. SecurityOnline, its first report on the story. WooCommerce stores hit by payment skimmer (CVE-2026-48907). Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:50 UTC. SecurityWeek, its first report on the story. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 08:25 UTC. SecurityOnline. AdGuard blocks Joomla exploit and launches email tracking shield. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 15:40 UTC. Security Affairs, its first report on the story. CISA flags critical Joomla JCE bug enabling remote code execution. Cites a CVE in CISA KEV.

The Known Exploited Vulnerabilities (KEV) Catalog maintained by CISA serves as a vital resource for the cybersecurity community, helping organizations prioritize vulnerabilities that are actively exploited. The catalog includes a detailed entry for CVE-2026-48907, a vulnerability in the Widget Factory Joomla Content Editor that allows unauthorized PHP code execution through improper access control. Users are urged to apply mitigations per vendor instructions and adhere to CISA's guidance on security updates.

The KEV catalog is accessible in various formats, such as CSV and JSON, and organizations can nominate additional vulnerabilities for inclusion. Regular updates can be subscribed to for ongoing awareness.

How the story developed

All 6 articles
Quiet for 19 weekslast report 17 Jun6 articles4 outlets

6 articles from 4 outlets since 16 Jun. Quiet since 17 Jun. This was the 2nd report, within the hour.

Now16 Jun17181929 OctFirst reportCISA · 16 Jun, 20:50
  • Tue 16 Jun, 20:50 UTC. CISA, first report. CISA adds critical Joomla editor flaw CVE-2026-48907 to KEV. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 21:37 UTC. CISA. CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited List. Cites a CVE in CISA KEV. This article, 2nd of 6.
  • Wed 17 Jun, 07:21 UTC. SecurityOnline, its first report on the story. WooCommerce stores hit by payment skimmer (CVE-2026-48907). Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:50 UTC. SecurityWeek, its first report on the story. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 08:25 UTC. SecurityOnline. AdGuard blocks Joomla exploit and launches email tracking shield. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 15:40 UTC. Security Affairs, its first report on the story. CISA flags critical Joomla JCE bug enabling remote code execution. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 6 articles as a list
  1. Tue 16 JunDay 02
    1. CISA adds critical Joomla editor flaw CVE-2026-48907 to KEV20:50 · CISA · official · First report · CISA alert · Known exploited CVE
    2. CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited List21:37 · CISA · official · Known exploited CVE · This article, 2nd of 6
  2. Wed 17 JunDay 14
    1. WooCommerce stores hit by payment skimmer (CVE-2026-48907)07:21 · SecurityOnline · Known exploited CVE
    2. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root07:50 · SecurityWeek · Known exploited CVE
    3. AdGuard blocks Joomla exploit and launches email tracking shield08:25 · SecurityOnline · Known exploited CVE
    4. CISA flags critical Joomla JCE bug enabling remote code execution15:40 · Security Affairs · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in