CVE-2026-48939 & CVE-2026-56291: Perfect-10 Joomla Extension Bugs (iCagenda, Balbooa Forms) Actively Exploited, Added to CISA KEV

CVE-2026-48939 & CVE-2026-56291 (TL-2026-1300), also tracked as Joomla Perfect-10 Extension Bugs, is a critical-severity software vulnerability scored CVSS 10, first published 2026-07-14. It has no confirmed attribution, affects JoomliC iCagenda (Joomla extension), references 2 CVEs (CVE-2026-48939, CVE-2026-56291), maps to 17 MITRE ATT&CK techniques (T1036.005, T1059, T1059.004), and is covered by 9 detection rules and 19 indicators of compromise.

Key facts for TL-2026-1300

Threat ID
TL-2026-1300
Also known as
Joomla Perfect-10 Extension Bugs, iCagenda Zero-Day RCE, Balbooa Forms Unauthenticated Upload
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-14
Last reviewed
2026-07-14
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, small and medium business, education, nonprofit, ecommerce, news - media
Target regions
Global, australia, North America, Europe
Detection rules
9
Indicators of compromise
19

Malware and tooling in CVE-2026-48939 & CVE-2026-56291

Malware and tooling: icagenda-batch

Two maximum-severity (CVSS 10.0) unauthenticated arbitrary file-upload vulnerabilities in the Joomla iCagenda calendar extension (CVE-2026-48939) and Balbooa Forms extension (CVE-2026-56291) are being actively exploited in the wild to plant PHP web shells and achieve remote code execution on compromised Joomla sites. Both were exploited as zero-days before patches shipped and were added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-10, amid a broader Five-Eyes-flagged, possibly AI-accelerated global campaign against CMS plugins.

How CVE-2026-48939 & CVE-2026-56291 works

iCagenda (CVE-2026-48939) is a Joomla events-calendar extension whose frontend "Submit an Event" form exposes an attachment upload feature. The access-control check for the upload was implemented only in the view layer and never enforced in the controller (com_icagenda, task=registration.submit), meaning an attacker did not need a real account or even a linked submission form — a CSRF/form token harvested from any public iCagenda page (e.g., the public events list) was sufficient to POST directly to the processing endpoint via the jform[attachment] parameter. The component preserved the attacker-supplied file extension and wrote the file verbatim into images/icagenda/frontend/attachments/, a web-root path with PHP execution enabled, yielding pre-authentication remote code execution. Automated exploitation using a scanner identifying itself via the User-Agent 'icagenda-batch/1.0' began around 2026-06-15 08:00 UTC, harvesting tokens, uploading a PHP web shell, and immediately fetching it to confirm execution — all fully automated. Vulnerable releases span 1.0.0 through 4.0.7 (mySites.guru additionally cites 3.2.1-3.9.14 and 4.0.0-4.0.7 as the actively targeted ranges); JoomliC shipped fixes in 3.9.15 and 4.0.8 on 2026-06-15/16.

Balbooa Forms (CVE-2026-56291) suffers a near-identical class of bug in its frontend attachment-upload handler (com_baforms, task=form.uploadAttachmentFile). The controller performed no authentication check and no Session::checkToken() CSRF validation, and derived the stored file's extension directly from the attacker-supplied filename with no allow-list or MIME validation, writing it with an attacker-controlled name into images/baforms/uploads/form-<id>/ inside the web root. Any anonymous visitor could therefore upload and immediately execute a file such as shell.php. mySites.guru discovered the flaw on 2026-07-08 while investigating a customer abuse report and confirmed active in-the-wild exploitation via access logs; Balbooa shipped a four-layer fix (extension allow-list, MIME validation, server-generated filenames, CSRF tokens) in version 2.4.1 on 2026-07-09. Affected versions run 1.0 through 2.4.0.

Both vulnerabilities share CWE-434 (Unrestricted Upload of File with Dangerous Type), CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and result in complete pre-auth RCE on the underlying web server user. CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog on 2026-07-10 with a three-day remediation deadline (2026-07-13) under Binding Operational Directive 26-04, ordering federal civilian agencies to patch or discontinue use. The exploitation of these two extensions is occurring against the backdrop of a much larger campaign: on 2026-07-09 the Australian Cyber Security Centre (ACSC) issued an alert on a large-scale global exploitation campaign against CMS platforms and plugins — including WordPress (WPBookit, Gravity Forms, Ninja Forms, Breeze Cache, WavePlayer), Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE — abusing unauthenticated file upload, RCE, SSRF, and deserialization bugs to deploy web shells at scale, disproportionately impacting small and medium businesses. A Five Eyes joint statement referenced in reporting on the campaign flagged that advances in AI are accelerating the speed and scale of such opportunistic mass-exploitation operations and shrinking the window between vulnerability disclosure and active exploitation.

MITRE ATT&CK techniques used in TL-2026-1300

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information

Execution

T1059 Command and Scripting Interpreter; T1059.004 Unix Shell

Command and Control

T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Persistence

T1136.001 Local Account; T1505.003 Web Shell

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1491.002 External Defacement

Resource Development

T1587.001 Malware; T1588.002 Tool

Reconnaissance

T1593.002 Search Engines; T1595.002 Vulnerability Scanning

Affected products and versions in CVE-2026-48939 & CVE-2026-56291

  • JoomliC — iCagenda (Joomla extension)
    Vulnerable versions: 1.0.0-4.0.7; 3.2.1-3.9.14; 4.0.0-4.0.7
    Fixed in: 3.9.15; 4.0.8
  • Balbooa — Balbooa Forms (Joomla extension)
    Vulnerable versions: 1.0-2.4.0
    Fixed in: 2.4.1

Remediation for CVE-2026-48939 & CVE-2026-56291

Patches

  • iCagenda 4.0.8 (current branch) — https://www.icagenda.com/docs/changelog/icagenda-4-0-8
  • iCagenda 3.9.15 (legacy 3.x branch) — https://www.icagenda.com/docs/changelog/icagenda-3-9-15
  • Balbooa Forms 2.4.1 — https://www.balbooa.com/joomla-forms

Immediate actions

  • Update iCagenda to version 4.0.8 (or 3.9.15 for the legacy 3.x branch) immediately
  • Update Balbooa Forms to version 2.4.1 immediately
  • Search images/icagenda/frontend/attachments/ and images/baforms/uploads/ for unexpected .php files or any non-image/non-document file types and remove them
  • Audit the Joomla administrator user list for unfamiliar or recently created accounts
  • Search the entire webroot for recently modified or created PHP files outside expected plugin/extension directories
  • Review web server access logs for the User-Agent string 'icagenda-batch/1.0' and for anonymous POSTs to index.php?option=com_icagenda&task=registration.submit or index.php?option=com_baforms&task=form.uploadAttachmentFile
  • Rotate all Joomla admin, database, and API credentials on any site confirmed compromised
  • Isolate and forensically image any site where a web shell is confirmed before remediation, per CISA's Forensics Triage Requirements under BOD 26-04

Workarounds

  • If patching is not immediately possible, disable the iCagenda frontend 'Submit an Event' feature and the Balbooa Forms frontend attachment-upload feature entirely
  • Block execution of PHP scripts within images/icagenda/frontend/attachments/ and images/baforms/uploads/ at the web server level
  • Restrict or firewall access to the com_icagenda registration.submit and com_baforms form.uploadAttachmentFile endpoints pending patch deployment

Longer-term hardening

  • Disable PHP execution in all Joomla media/uploads directories via web server configuration (e.g., Apache .htaccess / nginx location blocks) regardless of extension patch status
  • Deploy a Web Application Firewall (WAF) rule blocking uploads of executable file extensions to public-facing form/attachment endpoints
  • Implement file-type allow-listing and MIME-type validation on all third-party Joomla extension upload features
  • Establish a recurring inventory and patch-currency audit of all third-party Joomla extensions, not just Joomla core
  • Deploy file-integrity monitoring on Joomla webroots to detect newly created executable files in real time
  • Follow CISA BOD 26-04 prioritization guidance for internet-exposed CMS assets going forward

CVEs associated with CVE-2026-48939 & CVE-2026-56291

CVE-2026-48939, CVE-2026-56291

Weaknesses (CWE) in CVE-2026-48939 & CVE-2026-56291

CWE-434

Timeline of CVE-2026-48939 & CVE-2026-56291

  • JoomliC releases iCagenda 3.9.15 and 4.0.8 fixing CVE-2026-48939, within hours of researchers observing active exploitation.
  • Automated exploitation of CVE-2026-48939 (iCagenda) begins at approximately 08:00 UTC, with a scanner identifying itself as 'icagenda-batch/1.0' harvesting form tokens and uploading PHP web shells to unpatched sites.
  • mySites.guru publishes technical analysis of the iCagenda zero-day file-upload RCE, withholding a full copy-paste exploit but detailing the access-control bypass and detection guidance.
  • mySites.guru discovers the Balbooa Forms unauthenticated file-upload vulnerability (CVE-2026-56291) while investigating a customer abuse report, and confirms active in-the-wild exploitation via access logs.
  • Balbooa releases Forms version 2.4.1, adding extension allow-listing, MIME validation, server-generated filenames, and CSRF tokens to fix CVE-2026-56291.
  • The Australian Cyber Security Centre issues an alert on a large-scale global exploitation campaign against multiple CMS platforms and plugins (WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, Joomla JCE), deploying web shells at scale and disproportionately impacting small and medium businesses.
  • The Hacker News and SecurityWeek publish coverage of both Joomla extension flaws being exploited as zero-days and their addition to the CISA KEV catalog.
  • CISA adds both CVE-2026-48939 and CVE-2026-56291 to its Known Exploited Vulnerabilities catalog, setting a remediation due date of 2026-07-13 under BOD 26-04.
  • The Register publishes an article summarizing the ongoing exploitation of both 'perfect-10' Joomla extension vulnerabilities and the CISA KEV listing.

Sources cited for CVE-2026-48939 & CVE-2026-56291

Threats related to CVE-2026-48939 & CVE-2026-56291

Detection coverage for TL-2026-1300

As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1300 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats