CISA Adds Exploited Balbooa Forms File Upload RCE to KEV Catalog
Active Exploitation · 2 sources · Updated 4mo ago · First seen Jul 9, 2026
CISA added CVE-2026-56291 to its Known Exploited Vulnerabilities catalog after the flaw was disclosed as an unauthenticated arbitrary file upload bug in the Balbooa Forms extension for Joomla. The vulnerability affects versions 1.0 through 2.4.0 and allows attackers to upload executable files, leading to full remote code execution. The issue is tracked as CWE-434 and was assigned a high-severity CVSS v4 vector reflecting network-based exploitation, low attack complexity, and high impact across confidentiality, integrity, and availability.
The same KEV update also added CVE-2026-48939 in iCagenda, another unrestricted file upload flaw that can enable arbitrary file upload and PHP code execution. CISA's catalog update raised the total KEV count from 1,635 to 1,637 entries and set a 2026-07-13 remediation deadline for both vulnerabilities, while noting that known ransomware use is currently unknown.
