Exploitation observed; activity peaked at 3 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-05 | 3 | Disclosure3 |
| 2026-03-06 | 1 | Patch1 |
| 2026-03-20 | 1 | Active Exploitation1 |
| 2026-04-11 | 1 | Patch1 |
Jemand mit #Joomla im Web unterwegs? Im #Astroid Framework gibt es eine kritische Sicherheitslücke, die gerade aktiv für Angriffe genutzt wird. https://borncity.com/blog/2026/03/20/joomla-schwachstelle-cve-2026-21628-im-astroid-framework-wird-angegriffen/
Post summary
The post signals that CVE-2026-21628 in the Astroid framework is being actively exploited, yet it offers no technical details, PoC, or patch information.
Warning: Critical improperly secured file management vulnerability in #Astroid Framework #Joomla #CVE-2026-21628 CVSS: 10.0 A remote, unauthenticated attacker can exploit it for remote code execution #RCE! https://ccb.belgium.be/advisories/warning-critical-improperly-secured-file-management-astroid-framework-joomla-can-lead #Patch #Patch #Patch
Post summary
The advisory warns of a critical RCE (CVSS 10.0) in the Astroid Framework for Joomla (CVE‑2026‑21628) and emphasizes the need to apply a patch.
ICYMI: CVE-2026-21628 - CVSS 10.0 critical auth bypass in Astroid Framework for Joomla. Attackers upload backdoors without logging in. Update to 3.3.13 now. https://mysites.guru/blog/astroid-framework-security-vulnerability/?utm_source=twitter&utm_medium=social https://t.co/kVCqanGwLi
Post summary
The tweet highlights a critical auth bypass (CVE-2026-21628) in Joomla's Astroid Framework and directs users to the 3.3.13 patch.
CVE-2026-21628 Unauthenticated Remote Code Execution via Unrestricted File Upload Vulnerability https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-21628
Post summary
The post announces CVE-2026-21628, an unauthenticated RCE via unrestricted file upload, providing only basic technical details without evidence of exploitation or patches.
CVE-2026-21628 A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution. https://www.cve.org/CVERecord?id=CVE-2026-21628
Post summary
The post announces CVE-2026-21628 as a remote code execution flaw due to unsafe file uploads by unauthenticated users, but provides no PoC, exploit, patch info, or evidence of active exploitation.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-21628 - Extension - http://astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla Intel Report: https://ift.tt/bsaTWRr
Post summary
A new unauthenticated RCE vulnerability (CVE‑2026‑21628) in Astroid Framework 2.0.0‑3.3.10 for Joomla is announced, but the post provides no PoC, exploit, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | templaza | astroid_framework | - | joomla\! | - |