Two CVSS 10 Joomla Extensions Under Active Zero-Day Exploitation, Added to CISA KEV

Two Joomla extensions broke the same way within three weeks, and both breaks were already weaponized before anyone could patch. In Balbooa Forms, the frontend upload task at index.php?option=com_baforms&task=form.uploadAttachmentFile ran with no login, no CSRF token check, and no allow-list on the file extension, so an anonymous POST could plant a .php file under images/baforms/uploads/form-/ and execute it. That is CVE-2026-56291, CVSS 4.0 10.0, affecting 1.0 through 2.4.0; mySites.guru reported it on 8 July after a Hetzner abuse report caught live exploitation, and Balbooa shipped 2.4.1 the next day. In iCagenda, the submit-an-event controller enforced its access check only in the view that renders the form, never on the processing path, so a token harvested from any public iCagenda page let an anonymous user reach the file attachment upload and write attacker-named files to images/icagenda/frontend/attachments/. That is CVE-2026-48939, also CVSS 4.0 10.0, affecting 3.2.1 through 4.0.7; the upload-to-shell fires only on Joomla 6.0.0 through 6.1.1 because earlier cores block unsafe uploads, the guest event creation half works on every Joomla version, and JoomliC logged automated attacks from 15 June 08:00 UTC under the user agent icagenda-batch/1.0, fixing 4.0.8 the same day and 3.9.15 a day later. CISA added both to the KEV catalog on 10 July with forensic triage required and remediation due 13 July under BOD 26-04.

The KEV entries with the forensic triage flag mean CISA's position is that affected systems must be treated as potentially compromised, not merely patched, and that is the correct default here: iCagenda exploitation was running before, during, and after the fix shipped, and the tooling was built to grind through lists of Joomla sites, not to stumble onto one. Any site that ran Balbooa Forms 2.4.0 or earlier, or iCagenda on Joomla 6, carries a live compromise hypothesis until its access logs and upload folders say otherwise. The timeline frame of "patched in 2.4.1" undersells the exposure: 2.4.1 and 2.4.2 remained exploitable to a second pre-auth RCE, CVE-2026-65880 via the Signature field, fixed in 2.4.3 on 28 July, and 2.4.3.1 to two more pre-auth flaws, CVE-2026-67364 at 10.0 and CVE-2026-67363 at 7.7, fixed in 2.4.3.2 on 18 August, so having patched in July is not evidence of safety now. Balbooa compounded this by listing the RCE fix under a plain "Fixed" changelog heading with no security language and no advisory, which is exactly how admins who triage by changelog wording stay exposed. These two also sit in a cluster of Joomla extension upload-to-RCE zero days from the same weeks, including CVE-2026-56290 in Page Builder CK with the same score and vector, and that pattern, two CVSS 10 pre-auth upload flaws in one month, is what makes this story more than two bug tickets.

The patch targets are exact. Run iCagenda 4.0.8 or later on Joomla 4 through 6, or 3.9.15 or later on the Joomla 3 legacy branch, and because JoomliC shipped further security releases (4.0.12 and 3.9.16 on 14 August, 4.0.13 on 18 August) for separate flaws, install the current release rather than the June minimum; for Balbooa Forms the minimum is 2.4.3.2, which covers all four CVEs, not 2.4.1. Unpublishing iCagenda does not close the submit endpoint, and the developer's pre-patch stopgap was renaming the com_icagenda folders so Joomla cannot route to them; on Balbooa, blocking unauthenticated requests carrying the form.uploadAttachmentFile task at the web server or WAF takes the handler away while you update. Hunt on both sides: search access logs for POSTs to index.php?option=com_baforms&task=form.uploadAttachmentFile, for requests with the user agent icagenda-batch/1.0 followed by GETs of .php files, and for any file ending in .php under images/baforms/uploads/ or images/icagenda/frontend/attachments/, each of which is a web shell until proven otherwise. Then sort the Joomla users table by registration date for Super User accounts created since mid-June, and check the iCagenda queue for unapproved guest events, the signature of the access bypass on sites where core blocked the upload.

Two developments would change this assessment. First, exploit maturity: a public proof-of-concept repository for CVE-2026-48939 appeared on GitHub on 29 June and the Balbooa disclosure documents its endpoint at code level, so a scanner that crosses the two, aiming iCagenda-style automation at com_baforms, would start a second exploitation wave against the July-patched population. Second, further releases from either vendor: Balbooa shipped four security releases in six weeks and initially described its 18 August batch as routine hardening before two 10.0 CVEs landed, so any new Balbooa or JoomliC release lacking a CVE or affected range deserves immediate treatment as potentially pre-auth, and a KEV ransomware-use designation flipping from Unknown for either CVE would confirm the campaign has a monetization stage.