CISA Flags Joomla Content Editor Bug as Actively Exploited; CVSS 10.0
CVE-2026-48907 in Widget Factory's JCE extension hands attackers arbitrary file actions on unpatched Joomla sites. Federal agencies get the standard three weeks.
CISA added CVE-2026-48907 to its Known Exploited Vulnerabilities catalog on Tuesday, confirming what JCE admins have been muttering about for weeks: somebody is actively burning this bug in the wild.
It's a 10.0.
The flaw lives in Widget Factory's Joomla Content Editor (JCE), one of the most widely deployed editor extensions in the Joomla ecosystem. Root cause is improper access control — the kind of authorization gap that lets an unauthenticated request reach functionality that was never supposed to be exposed. Successful exploitation gives an attacker arbitrary file operations against the host, which in practice means dropping a PHP webshell into a writable directory and walking in the front door.
No authentication. No user interaction. Network vector. That's how you get to a perfect CVSS.
CISA has not named the threat actor or published indicators, which is typical for a fresh KEV add. The agency's catalog entry simply notes evidence of active exploitation and sets the remediation deadline for federal civilian agencies under BOD 22-01. Private-sector defenders aren't bound by the directive, but the KEV list has become the de facto patch-priority queue for anyone running a serious vulnerability management program.
The practical problem: JCE is an extension, not core Joomla. That means it doesn't get patched when you click "Update" on the CMS itself. Site operators have to log into the Joomla extension manager and update JCE separately, which is exactly the kind of step that gets skipped on the dozens of marketing sites every mid-sized org somehow ends up running.
What to do, in order:
- Inventory every Joomla install you own, including the ones marketing forgot about.
- Pull the JCE version string from each and compare against the fixed release published on the JCE downloads page.
- Hunt for unexpected PHP files in
/images/,/media/, and any JCE-managed upload directories — webshells dropped via arbitrary file write are the predictable post-exploitation move. - Review web server access logs for anomalous POST requests to JCE endpoints, particularly anything touching the file browser or upload handlers.
If you can't patch immediately, restricting access to the Joomla administrator path at the web server or WAF layer cuts the blast radius (though it won't necessarily close an unauthenticated vector — read the advisory before assuming you're covered).
Joomla itself has historically been a soft target for mass exploitation campaigns, and editor extensions with file-handling capabilities are a recurring weak point. This won't be the last one. Get the inventory done now so the next KEV add isn't a fire drill.
