US Cyber Agency Flags Two Joomla Add-On Flaws Already Being Exploited

Key points

• The U.S. Cybersecurity and Infrastructure Security Agency added two Joomla extension flaws to its Known Exploited Vulnerabilities catalog after reports of live attacks.
• Both vulnerabilities carry the maximum CVSS score of 10.0: CVE-2026-48939 in iCagenda and a matching flaw in Balbooa.
• The bugs were exploited as zero-days, meaning attackers found and used them before fixes were widely available.
• Website owners running either extension should check server logs now and treat any anomaly as a breach.

Two add-ons for the Joomla website builder are under active attack, and the U.S. Government wants them fixed fast.

CISA added flaws in the iCagenda calendar plugin and the Balbooa forms plugin to its Known Exploited Vulnerabilities catalog: Washington's running list of security holes criminals are already using in real attacks. Both bugs scored 10.0 on the CVSS scale, which runs from 0 to 10. A perfect 10 means the flaw is trivial to exploit, requires no authentication, and hands an attacker deep access. There's no worse rating.

What is Joomla and why does this matter?

Joomla is a content management system, software that lets people build and run websites without writing code from scratch. Think of it as a rival to WordPress, used by small businesses, universities and community groups worldwide.

Extensions are the add-on tools that give a Joomla site extra features. ICagenda handles event calendars; Balbooa builds contact forms and page layouts. When an extension carries a critical flaw, every site running it becomes a target, even if the core Joomla software is fully patched.

How did attackers exploit these bugs?

One tracked flaw, CVE-2026-48939, sits inside iCagenda. According to The Hacker News, both flaws were exploited as zero-days. A zero-day is a bug the software's maker hadn't yet fixed when attackers started using it, leaving defenders with no preparation time at all.

CISA hasn't published technical details of how the attacks work. That's normal while patching is still under way, because specifics make it easier for copycats to pile in.

What we do know: a 10.0 score on a web plugin almost always means remote code execution, jargon for an attacker running their own commands on your server from anywhere in the world. From there they can steal data, plant backdoors or serve malware to every visitor. We first covered these extensions on 13 July 2026, when CISA's earlier KEV additions pointed at the same Joomla ecosystem.

Who has to act, and by when?

Federal civilian agency must fix any vulnerability on the KEV list within a set deadline. If a patch isn't available, the agency has to stop using the affected product.

CISA also strongly urges private companies to follow the same process. It's not a legal order for a small charity or a regional retailer, but it's the closest thing to an official siren the U.S. Government issues about a specific bug.

Regulatory exposure doesn't stop at the U.S. Border. A breached site holding personal data on European visitors could trigger notification duties under the UK Information Commissioner's Office or an EU data-protection authority under GDPR.

What should site owners do now?

Log in to your admin panel and check whether iCagenda or Balbooa are installed. Update them to the latest available versions immediately. If no fixed version exists yet, disable the extension until one ships.

Then check your server logs for unusual POST requests to the extension's URLs, unexpected new admin accounts or files you didn't upload. Anything odd and you should treat the site as breached: rotate all passwords and API keys tied to it.

For ordinary visitors there's nothing to install or change. If you gave contact details to a small Joomla-powered site recently, watch for a rise in targeted phishing emails, fake messages designed to trick you into clicking or paying.