The US Cybersecurity and Infrastructure Security Agency has flagged four add-ons for the Joomla content management system as under active attack, and every one of them carries the maximum severity score of CVSS 10.
The flaws are in add-ons, not in Joomla itself. That distinction matters, because a site running a fully patched Joomla core is still exposed if it has one of these extensions installed. Three of the four are classed as unrestricted upload of a file with a dangerous type, and the fourth as an improper access control failure that leads to the same outcome: a file arriving from someone who never logged in.
What is affected
CISA added the entries to its Known Exploited Vulnerabilities catalog, the list it maintains of bugs it has evidence attackers are already using, across two batches in July 2026:
- JoomShaper SP Page Builder (CVE-2026-48908), added July 7. NVD says the flaw allows unauthenticated users to upload arbitrary files, resulting in the upload and execution of PHP code. It carries the highest exploitation probability of the group, an EPSS score of 0.88, in the 99.75th percentile.
- Joomlack Page Builder (CVE-2026-56290), added July 7. NVD describes an improper access control flaw that could allow remote code execution through unauthenticated arbitrary file upload. EPSS 0.83.
- Balbooa Forms (CVE-2026-56291), added July 10. NVD describes an unauthenticated arbitrary file upload that could allow uploading executable files, leading to full remote code execution. EPSS 0.76.
- iCagenda (CVE-2026-48939), added July 10. NVD places the flaw in the extension's file attachment feature and says it ultimately results in PHP code upload and execution. EPSS 0.24, the lowest of the four, though still in the 97.6th percentile.
None of the four is marked as linked to known ransomware use in the catalog. That is not evidence they are safe, only that CISA has not tied them to a ransomware operation.
Why this cluster stands out
Page builders and form extensions are among the parts of a site most likely to accept a file from a visitor, which is what puts them in this category of bug in the first place. All four are reachable from the open internet by design. The catalog entries give the vulnerability class, the score and the exploitation evidence, and nothing about how the attacks are being carried out or by whom, so the vendor advisories remain the place to look for specifics.
The remediation deadlines CISA set have already passed. The July 7 entries were due by July 10 and the July 10 entries by July 13. Those deadlines bind US federal civilian agencies, but CISA urges every organization to treat the catalog as a priority patch list. IntelFusions first noted two of these Joomla flaws alongside an Adobe ColdFusion listing in early July, and the agency has kept up a steady run of content management additions since, including two WordPress core bugs later that month.
What you should do
Update SP Page Builder, Joomlack Page Builder, Balbooa Forms and iCagenda to their current releases. The catalog entries do not list fixed version numbers, so check each vendor's advisory for the version you need. If your site does not actually use one of these extensions, remove it rather than leaving it installed and unpatched.
Because CISA lists all four as already exploited, patching alone is not enough. Audit the upload and attachment directories for files that should not be there, particularly anything ending in .php, and review the site for administrative accounts you do not recognize. The NVD entries are the primary references: CVE-2026-48908, CVE-2026-56290, CVE-2026-56291 and CVE-2026-48939.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.