Vulnerability intelligence
CVE-2026-48939
A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
CVSS Score
10
Critical
EPSS — Exploit Probability
83%
Riskier than 100% of all CVEs
Exploitation
Confirmed in the wild
KEV since 2026-07-10
Remediation
Patch available
Federal deadline 2026-07-13
6 articles across 5 outlets · first covered Jul 10, 2026 · latest Jul 13, 2026
Tracked incidents
Associated threat actors
Coverage timeline
-
Unauthenticated RCE Flaws Hit Joomla Extensions Balbooa, iCagendawww.securityweek.com · Jul 13, 2026
-
CISA Flags iCagenda, Balbooa Forms Flaws; Urges Fix by July 2026securityaffairs.com · Jul 11, 2026
-
Apache IoTDB Fixes Path Traversal and Authentication Bypass Flaws (CVE-2026-24014)securityonline.info · Jul 11, 2026
-
Silver Fox uses SEO tricks to drop MODBEACON trojan via bugssecurityonline.info · Jul 11, 2026
-
CISA KEV Flags iCagenda File Upload Flaw CVE-2026-48939www.cisa.gov · Jul 10, 2026
-
CISA Adds CVE-2026-48939 to Known Exploited Vulnerabilities Cataloguecisa.gov · Jul 10, 2026