CISA Flags Actively Exploited JCE Joomla Plugin RCE
Active Exploitation · 17 sources · Updated 3mo ago · First seen Jun 17, 2026
CISA added CVE-2026-48907 to its Known Exploited Vulnerabilities catalog after reports of active exploitation against the Widget Factory Joomla Content Editor (JCE) plugin. The maximum-severity improper access control flaw lets unauthenticated attackers create new editor profiles and then upload and execute PHP code, resulting in remote code execution on vulnerable Joomla sites. The KEV update raised the catalog total to 1,622 entries and set a federal remediation deadline of 2026-06-19 under BOD 26-04.
Vendor and media reporting said the issue affects JCE versions 1.0.0 through 2.9.99.4, with fixes released in 2.9.99.5 and later, including JCE Pro 2.9.99.6. The JCE team also issued a free patch for older sites and warned that public exploit code is available, attacks are automated, and sites without public registration can still be targeted. Security reporting noted that applying the update blocks the initial access path but does not remove any persistence, web shells, or malware that attackers may already have deployed on compromised servers.
