CVE-2026-21627Exploit

LOWCVSS 9.5 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Prioritize remediation for affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.

Back to dashboard

3.5/ 10 priority

Sources & remediation

Other references

https://tassos.gr

Weakness type (CWE)

CWE-284

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC and exploit tooling are both present
3 mentions across 3 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 2 signals
PoC mentioned or linked in 2 signals
Technical details provided in 3 signals
Disclosure: 1 classified signal
Peaked 2d ago at 1 mentions (2026-02-20); latest day: 1
3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

Exploit

266.7%

Disclosure

133.3%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-20	1	Disclosure1
2026-03-30	1	Exploit1
2026-04-12	1	Exploit1

Full discourse3 posts

Manage Multiple WordPress and Joomla Sites easily!@mysitesguru192d
Exploit
CVE-2026-21627 - CVSS 9.5 critical vuln in the Tassos/Novarain Framework for Joomla. Unauthenticated file inclusion, SQL injection, file deletion. Public exploit on GitHub. 8,297 of our connected sites have it. 46.5% still vulnerable. https://mysites.guru/blog/novarain-framework-joomla-vulnerability/?utm_source=twitter&utm_medium=social #Joomla https://t.co/kO72uHq7Ga
Post summary
The CVE‑2026‑21627 vulnerability in the Novarain Framework for Joomla offers unauthenticated file inclusion, SQL injection, and file deletion, with a public exploit on GitHub and numerous infected sites still vulnerable.
00020170
2.5K followersView on X
Manage Multiple WordPress and Joomla Sites easily!@mysitesguru179d
Exploit
ICYMI: CVE-2026-21627 - CVSS 9.5 critical vuln in the Tassos/Novarain Framework for Joomla. Unauthenticated file inclusion, SQL injection, file deletion. Public exploit on GitHub. 8,297 of our connected sites have it. 46.5% still vulnerable. https://mysites.guru/blog/novarain-framework-joomla-vulnerability/?utm_source=twitter&utm_medium=social #Joomla https://t.co/nAo565r41a
Post summary
The tweet highlights CVE-2026-21627, a critical Joomla framework vulnerability with file inclusion and SQLi, notes a public exploit on GitHub, and reports that many sites remain vulnerable.
0000093
2.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds230d
Disclosure
CVE-2026-21627 Unauthenticated Remote Code Execution in Tassos Framework Joomla Plugin https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-21627
Post summary
The text announces CVE‑2026‑21627 as an unauthenticated remote code execution flaw in the Tassos Framework Joomla Plugin, providing only the basic vulnerability classification without additional technical details, PoC, or patch information.
0000036
4.0K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-21627

Manage Multiple WordPress and Joomla Sites easily![verified]@mysitesguruExploit

The CVE‑2026‑21627 vulnerability in the Novarain Framework for Joomla offers unauthenticated file inclusion, SQL injection, and file deletion, with a public exploit on GitHub and numerous infected sites still vulnerable.

Manage Multiple WordPress and Joomla Sites easily![verified]@mysitesguruExploit

The tweet highlights CVE-2026-21627, a critical Joomla framework vulnerability with file inclusion and SQLi, notes a public exploit on GitHub, and reports that many sites remain vulnerable.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces CVE‑2026‑21627 as an unauthenticated remote code execution flaw in the Tassos Framework Joomla Plugin, providing only the basic vulnerability classification without additional technical details, PoC, or patch information.