CISA Flags Joomla Content Editor Bug as Actively Exploited; CVSS 10.0
CVE-2026-48907 in Widget Factory's JCE extension hands attackers arbitrary file actions on unpatched Joomla sites. Federal agencies get the standard three weeks.
Key points - CISA added CVE-2026-48907 to its Known Exploited Vulnerabilities catalog on Tuesday, citing active exploitation. - The flaw carries a maximum CVSS score of 10.0 and requires no authentication or user interaction. - Root cause is improper access control in Widget Factory's Joomla Content Editor (JCE) extension. - Successful exploitation enables arbitrary file operations, the practical path to dropping a PHP webshell. - JCE updates through the Joomla extension manager, not through a core CMS update, so patching it gets missed.
CISA added CVE-2026-48907 to its Known Exploited Vulnerabilities catalog on Tuesday, confirming what JCE admins have suspected: somebody is actively burning this bug in the wild.
It's a 10.0.
The flaw lives in Widget Factory's Joomla Content Editor (JCE), one of the most widely deployed editor extensions in the Joomla ecosystem. The root cause is improper access control, an authorization gap that lets an unauthenticated request reach functionality never meant to be exposed. Successful exploitation gives an attacker arbitrary file operations against the host, which in practice means dropping a PHP webshell into a writable directory and walking straight in.
No authentication required. No user interaction needed. Network-reachable by default. That combination produces a perfect CVSS score every time.
CISA has not named a threat actor or published indicators, typical for a fresh KEV addition. Private-sector defenders aren't bound by the directive, but the KEV list has become the de facto patch-priority queue for anyone running a serious vulnerability management program. We first flagged Joomla as a recurring KEV target on 17 June 2026, and a pattern has since built up across the CMS ecosystem, including the Magento Cache Extension KEV add we reported on 4 June.
Should you worry about the extension-not-core problem?
Yes, because it's the thing most site operators get wrong. JCE is an extension, not core Joomla. It doesn't get patched when you click "Update" on the CMS itself. Site operators have to log into the Joomla extension manager and update JCE separately, exactly the step that gets skipped on the dozen marketing sites every mid-sized org quietly accumulates.
What to do, roughly in order:
- Inventory every Joomla install you own, including the ones marketing forgot about.
- Pull the JCE version string from each and compare against the fixed release on the JCE downloads page.
- Hunt for unexpected PHP files in
/images/,/media/, and any JCE-managed upload directories. - Review web server access logs for anomalous POST requests to JCE endpoints, particularly anything touching the file browser or upload handlers.
If you can't patch immediately, restricting access to the Joomla administrator path at the web server or WAF layer cuts the blast radius, though it won't necessarily close an unauthenticated vector. Read the advisory before assuming you're covered.
Common questions
Does this affect Joomla core?
No. CVE-2026-48907 is specific to the JCE extension published by Widget Factory. A fully updated Joomla core installation running a vulnerable JCE version remains exposed.
What does the attacker actually do after getting in?
The predictable post-exploitation move is arbitrary file write to place a PHP webshell in a publicly accessible directory, giving persistent remote code execution without any further credentials.
Joomla has historically been a soft target for mass exploitation campaigns, and editor extensions with file-handling capabilities are a recurring weak point. Get the inventory done now so the next KEV add isn't a fire drill.
