CISA Adds Max-Severity Joomla Content Editor Flaw CVE-2026-48907 to KEV as Attackers Drop Web Shells via Rogue Editor Profiles
An unauthenticated RCE in the JCE extension, scored CVSS 4.0 10.0, is being exploited to plant web shells. CISA set a June 19 federal deadline.
Overview
The U.S. Cybersecurity and Infrastructure Security Agency added a maximum-severity flaw in the widely deployed Joomla Content Editor (JCE) extension to its Known Exploited Vulnerabilities catalog on June 16, 2026, after evidence emerged that attackers were using it to upload web shells onto vulnerable servers. According to the CISA KEV catalog, the bug, tracked as CVE-2026-48907, is an improper access control vulnerability in the Widget Factory Joomla Content Editor that “could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.”
The vulnerability requires no credentials. Per the NVD, it carries a CVSS 4.0 base score of 10.0 and a CVSS 3.1 score of 9.8, both rated Critical, and is classified under CWE-284 (Improper Access Control). The NVD describes it as “a vulnerability in the JCE editor extension for Joomla” that “allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.”
What We Know
JCE is one of the most common third-party extensions in the Joomla ecosystem, which makes the exposure broad. SC Media reports that the editor is used by roughly 83.7% of Joomla sites as of 2020, and that the underlying CMS powers about 1.2% of websites globally.
The NVD lists JCE versions 1.0.0 through 2.9.99.4 as affected, with 2.9.99.5 and later unaffected. According to mySites.guru, Widget Factory shipped the fix in JCE Pro and JCE Free 2.9.99.5 on 3 June 2026. The release notes for that version, quoted by mySites.guru, stated that “insufficient access controls permitted unauthenticated users to upload editor profiles.” The CVE itself was published on June 5, 2026, per the NVD.
The technical root cause is a chain of design failures in the profile-import workflow. The disclosure by YesWeHack, whose researchers analyzed the flaw, breaks it into three weaknesses: the import endpoint’s “only gate was a CSRF token check,” which “does not prevent a direct, scripted request from an attacker who harvests the token themselves”; the sanitizer “does not inspect or restrict the file extension”; and the upload call “explicitly disabled Joomla’s built-in extension safety net.” Together, YesWeHack writes, these allow “unauthenticated attackers to upload and execute arbitrary PHP code via the /tmp directory, leading to pre-auth RCE in default or weakly hardened Joomla deployments.”
The attack pattern in the wild matches that mechanism. According to mySites.guru, an unauthenticated visitor uploads a malicious editor profile that defines permissive file-upload rules, then uses that profile to upload PHP web shells. Researchers, it adds, “later found exactly this attack on a live Joomla site, a rogue editor profile built to permit php uploads with the webshells it was used to drop still sitting on disk.” SC Media quotes mySites.guru describing the campaign as “automated tooling spraying the same exploit at every JCE install it can reach,” and reports that attackers “have exploited this flaw to drop webshells on hundreds of sites.”
The flaw was reported by Uwe Flottemesch of fc-hosting.de, with assistance from David Jardin, lead of the Joomla Security Strike Team, according to mySites.guru.
Federal Deadline
The CISA KEV catalog sets a due date of June 19, 2026, three days after the entry was added, requiring Federal Civilian Executive Branch agencies to patch or otherwise mitigate. The compressed window reflects CISA’s BOD 26-04, the risk-based directive cited in the catalog’s required-action text and which The Machine Herald previously reported replaces the older CVSS-threshold model with a three-day patch clock for the most dangerous flaws. SC Media likewise notes the three-day deadline.
Patching alone may not be sufficient for already-compromised sites. mySites.guru advises administrators to search access logs for requests to JCE endpoints made with no Joomla session cookie, audit upload directories for unexpected files with recent timestamps, and scan for backdoors, because a rogue profile and any web shell it dropped will persist after the extension is updated. YesWeHack recommends upgrading to version 2.9.99.6 or later, which adds further hardening beyond the initial 2.9.99.5 fix.
What We Don’t Know
The full scale of exploitation is not established. The “hundreds of sites” figure comes from one researcher’s observations relayed by SC Media, not from a comprehensive survey. The CISA KEV catalog lists the flaw’s known ransomware-campaign use as “Unknown,” meaning CISA has not tied it to a named ransomware operation. Accounts also differ on whether a public proof-of-concept is circulating: SC Media reports a proof-of-concept was published to GitHub on June 9, while mySites.guru states there is no public PoC in circulation. The identity of the operators behind the automated scanning has not been disclosed by any of the cited sources.