CuraSec

tag: Joomla · 2 items

Act archived CISA: Joomla iCagenda and Balbooa Forms extensions actively exploited for RCE
2026-07-14 · BleepingComputer · source ↗ #joomla#rce#active-exploitation
  • Engineer — Act: CISA warning signals KEV-level active exploitation — update or disable the iCagenda and Balbooa Forms Joomla extensions immediately, and audit web roots for unexpectedly uploaded files that may indicate prior compromise.
  • SOC/IR — Act: Active exploitation via arbitrary file upload means webshells may already be in place — hunt Joomla web directories for recently uploaded executables and review web server logs for POST requests targeting these extension upload endpoints.
  • Leader — Plan: Confirm whether any company-owned or vendor-hosted web properties run Joomla with these extensions and verify engineering teams have patch SLAs in motion; this does not yet rise to board-briefing level.
Act archived Joomla iCagenda & Balbooa Forms Zero-Days Added to CISA KEV
2026-07-13 · The Hacker News · source ↗ #joomla#zero-day#cisa-kev
  • Engineer — Act: CISA KEV-listed, CVSS 10.0, actively exploited as zero-days with a public PoC on GitHub — patch iCagenda and Balbooa Forms Joomla extensions to the latest fixed versions immediately if these are in your stack.
  • SOC/IR — Act: In-the-wild zero-day exploitation of web-facing Joomla components means you should assume compromise may predate patching — sweep web access logs for anomalous requests targeting these extension endpoints and confirm whether any estate assets run Joomla with either plugin.
  • Leader — Plan: CISA KEV listing at CVSS 10.0 warrants a same-week inventory check of web properties for Joomla usage with these extensions; if confirmed in use, escalate to engineering for urgent remediation before this surfaces in a customer questionnaire or audit.
  • Signals: CVE-2026-48939 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub