CISA KEV: Two New Joomla Extension Entries Added July 10 — iCagenda and Balbooa Forms

CISA added CVE-2026-48939 and CVE-2026-56291 to the KEV catalog on July 10 with a federal remediation due date of July 13, and both are unauthenticated file upload flaws that end the same way: arbitrary PHP running on the web server. CVE-2026-48939 sits in the attachment field of iCagenda's public Submit an Event form; the component accepts the caller's file extension with no allow-list and writes under the web root at images/icagenda/frontend/attachments/, and the vendor's advisory scopes upload-to-shell to Joomla 6, because earlier Joomla branches block unsafe uploads in core. CVE-2026-56291 is Balbooa Forms, where the com_baforms upload task runs with no login, no CSRF token, and no type check, dropping attacker-controlled .php files into images/baforms/uploads/ that execute on any Joomla version. Both carry CVSS 9.8 from the Joomla CNA, 10.0 under v4.0, and both were exploited before fixes existed: a bot calling itself icagenda-batch/1.0 has been hitting iCagenda since June 15, and the Balbooa flaw surfaced through a Hetzner abuse report days before 2.4.1 shipped on July 9.

The telling detail is not either CVE alone but the company they keep. These are the third and fourth Joomla extension upload-to-RCE flaws to reach KEV inside one week, after SP Page Builder (CVE-2026-48908) and the Joomlack Page Builder (CVE-2026-56290) landed on July 8 and 10, part of a catalog CISA describes as six newly exploited CVEs this week and twenty in the last 30 days. The exposed surface is the extension marketplace, not Joomla core, so a fully patched core running an old com_icagenda or com_baforms is still a shell waiting for a request, and both endpoints run pre-auth on any page a visitor can reach. The event data scores the two identically at 9.8 with EPSS of 2 and 1 percent, but the exposure is asymmetric: the iCagenda shell only lands on Joomla 6 while Balbooa's executes regardless of platform version, and the disclosing researcher counts Balbooa Forms in use on thousands of sites, which makes CVE-2026-56291 the broader risk despite identical scores. KEV listing is itself the exploitation evidence; the low EPSS values just measure lagging telemetry.

Patch iCagenda to 4.0.8 minimum, or 3.9.15 on the Joomla 3 branch, and Balbooa Forms past 2.4.1, but treat both as floors that have already moved: Balbooa shipped 2.4.3 on July 28 fixing a second pre-auth RCE, CVE-2026-65880, scored 10.0, reached through the Signature field, then 2.4.3.1 and 2.4.3.2, and iCagenda followed 4.0.8 with 4.0.12, 4.0.13, and 3.9.16, including a fix for a 9.2-scored unauthenticated SQL injection in its Calendar module. Unpublishing the component does not help, since the endpoint stays routable, so version level is the only real control. Then hunt, because exploitation on the iCagenda side predates the KEV listing by nearly a month: look for stray .php files in images/icagenda/frontend/attachments/ and images/baforms/uploads/, search access logs for POSTs naming task=form.uploadAttachmentFile, requests carrying the user agent icagenda-batch/1.0, and GETs fetching .php from those folders right after a POST, and review the Balbooa site for unexpected administrator accounts and the iCagenda event queue for guest-created unapproved entries, a second lower-severity bug in the same submit flow. Federal agencies are on the BOD 26-04 clock with forensic triage required and the July 13 due date already set.

Two developments would change this assessment. A public proof of concept for CVE-2026-56291 would let opportunistic scanners replicate at scale what the icagenda-batch/1.0 bot did weeks earlier; none has surfaced for the Balbooa flaw, while the iCagenda exploit is already published on GitHub. Ransomware use is listed as Unknown for both entries, and an attribution there would escalate this from commodity webshell planting to an extortion precursor and force a compromise hunt well beyond access-log review.