iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days
Summary: CISA added two maximum-severity Joomla extension flaws, both rated 10.0 on CVSS, to its Known Exploited Vulnerabilities catalog after reports of zero-day exploitation in the wild. CVE-2026-48939 in iCagenda's "Submit an Event" form was exploited since June 15, 2026, and CVE-2026-56291 in Balbooa Forms up to version 2.4.0 allowed unauthenticated file upload and remote code execution, discovered July 8, 2026 after a live attack on a mySites.guru customer.
Bottom line: Both flaws are rated 10.0 and were already being exploited before patches existed, with FCEB agencies given until July 13, 2026 to apply fixes. The ACSC ties this to a global campaign deploying web shells across CMS software, and notes that AI advances are compressing the time between disclosure and exploitation.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-48939CVE-2026-56291
- Related
- CVE-2026-48939: iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability Known Exploited Vulnerabilities · Jul 10, 2026CVE-2026-56291: Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability Known Exploited Vulnerabilities · Jul 10, 2026New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026