CISA Flags Exploited Joomla iCagenda and Balbooa Forms RCE Flaws
Active Exploitation · 10 sources · Updated 4mo ago · First seen Jul 11, 2026
CISA added two Joomla extension vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after reports of active zero-day abuse against public-facing sites. The flaws, CVE-2026-48939 in iCagenda and CVE-2026-56291 in Balbooa Forms, are unrestricted file upload bugs that let attackers upload executable PHP files and gain remote code execution; the iCagenda issue carries a CVSS 10.0 rating. Under Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies were ordered to remediate both issues by July 13, 2026.
Reporting cited by CISA said automated exploitation of the iCagenda flaw began on June 15, while the Balbooa Forms bug was identified during a live customer attack on July 8. Vendors have released fixes, with JoomliC patching iCagenda in versions 4.0.8 and 3.9.15, and Balbooa Forms addressing its vulnerability in version 2.4.1. The warning comes amid broader alerts, including from Australia’s ACSC, about global campaigns targeting CMS platforms and plugins to plant web shells, and CISA urged organizations beyond the federal government to review the KEV catalog and remediate affected systems.
