Exploitation observed; activity peaked at 26 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-06-19. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-05 | 2 | Disclosure1Patch1 |
| 2026-06-10 | 2 | Exploit1General1 |
| 2026-06-11 | 1 | PoC1 |
| 2026-06-12 | 2 | Disclosure1PoC1 |
| 2026-06-13 | 2 | Exploit1PoC1 |
| 2026-06-14 | 5 | Disclosure2Patch1PoC2 |
| 2026-06-15 | 2 | Active Exploitation1PoC1 |
| 2026-06-16 | 2 | Patch2 |
| 2026-06-17 | 26 | Active Exploitation15Disclosure3General1Patch6PoC1 |
| 2026-06-18 | 8 | Active Exploitation6Disclosure1Exploit1 |
| 2026-06-19 | 8 | Active Exploitation6Disclosure1General1 |
| 2026-06-20 | 1 | Active Exploitation1 |
| 2026-06-21 | 1 | Active Exploitation1 |
| 2026-06-22 | 2 | Active Exploitation2 |
| 2026-06-23 | 6 | Active Exploitation5Patch1 |
| 2026-06-24 | 3 | Active Exploitation2Disclosure1 |
| 2026-06-25 | 3 | Active Exploitation2General1 |
| 2026-06-26 | 1 | Active Exploitation1 |
| 2026-06-27 | 2 | Active Exploitation1PoC1 |
| 2026-06-28 | 2 | Disclosure2 |
| 2026-06-29 | 2 | PoC2 |
| 2026-07-01 | 1 | PoC1 |
| 2026-07-08 | 3 | Disclosure3 |
| 2026-07-10 | 2 | Active Exploitation1General1 |
| 2026-07-11 | 4 | Active Exploitation1Disclosure3 |
| 2026-07-12 | 1 | General1 |
| 2026-07-13 | 1 | Disclosure1 |
| 2026-07-18 | 2 | Disclosure1PoC1 |
| 2026-07-20 | 2 | Disclosure1PoC1 |
| 2026-07-21 | 1 | Active Exploitation1 |
| 2026-07-30 | 1 | Patch1 |
| 2026-07-31 | 1 | Active Exploitation1 |
| 2026-08-11 | 1 | Exploit1 |
| 2026-08-12 | 2 | General1PoC1 |
| 2026-08-18 | 2 | Disclosure1Exploit1 |
| 2026-08-20 | 1 | Patch1 |
| 2026-08-22 | 1 | Active Exploitation1 |
| 2026-08-25 | 1 | General1 |
| 2026-08-28 | 1 | Patch1 |
| 2026-09-07 | 1 | Disclosure1 |
| 2026-09-16 | 2 | Disclosure1PoC1 |
| 2026-09-17 | 1 | Active Exploitation1 |
| 2026-09-30 | 1 | Active Exploitation1 |
#CVE-2026-48907 Unauthenticated RCE in #Joomla Content Editor Extension https://t.co/CRC02Xm5ag
Post summary
The tweet announces the discovery of an unauthenticated remote code execution vulnerability (CVE‑2026‑48907) in a Joomla Content Editor Extension.
‼️ CVE-2026-48907: Joomla! JCE extension 2.9.99.5 - unauthenticated Remote Code Execution Video Credit: @0xgh057r3c0n https://t.co/MYdu7vKC29
Post summary
The tweet announces a new unauthenticated RCE vulnerability (CVE-2026-48907) affecting Joomla! JCE extension 2.9.99.5, with clear technical details but no evidence of exploitation or remediation information.
‼️🚨 A critical Joomla Content Editor vulnerability is under active attack and rated CVSS 10.0. Joomla is used by 1.2% of all websites on the internet. The vulnerability, CVE-2026-48907: an unauthenticated attacker can create an editor profile, upload PHP, and take full control of the site. CISA and Italy's CSIRT have both issued alerts.
Post summary
CVE‑2026‑48907 is a critical Joomla vulnerability that is actively exploited, allowing unauthenticated attackers to create an editor profile, upload PHP code, and gain full site control.
🚨 A GitHub repository is promoting a scanner for CVE-2026-48907, a critical Joomla Content Editor vulnerability affecting JCE versions before 2.9.99.5. https://github.com/gh1mau/masta-cve-2026-48907 Advertised capabilities include: • Joomla and JCE fingerprinting • Version checks for vulnerable JCE installs • WAF detection • Bulk target scanning • Threaded scanning support • Proxy support • Terminal result cards • Excel report generation • Intrusive proof-of-concept verification • Cleanup reminders for uploaded test files
Post summary
A GitHub repository offers a scanner that performs intrusive proof‑of‑concept verification for the Joomla JCE CVE‑2026‑48907 vulnerability.
🚨 CVE-2026-48907 — JoomlaSniper v1.0 released Unauthenticated RCE in Joomla JCE Editor (≤2.9.99.4) CVSS 10.0 • Affects ALL production versions File upload → PHP execution in /tmp/ — no auth required 🔗 http://github.com/ynsmroztas/JoomlaSniper --- 🧵 2/3 Tool features: ✅ Dual vector (tmp/ + JCE browser) ✅ Interactive shell ✅ Zero dependencies (stdlib only) ✅ Pipeline: subfinder | httpx | JoomlaSniper ✅ Multi-function fallback (shell_exec → system → passthru) ✅ Auto store code detection Fixed in JCE 2.9.99.5 --- 🧵 3/3 Quick test: python3 http://JoomlaSniper.py -u http://target.com --shell Subdomain tarama: subfinder -d http://target.com | httpx -silent | python3 http://JoomlaSniper.py ⚠️ Authorized testing only #BugBounty #InfoSec #RedTeam #AppSec #bugbountytip #bugbountytips #infosec #recon
Post summary
The post announces a released PoC tool called JoomlaSniper that provides a functional exploit for CVE‑2026‑48907, identifies key vulnerability details, and mentions a vendor patch.
Resources: 🔗 https://github.com/gh1mau/masta-cve-2026-48907 🔗 https://cve.org/CVERecord?id=CVE-2026-48907 🔗 GHSA-c3f5-4g7f-qjqj 🔗 https://yeswehack.com/news/rce-joomla-content-editor-extension Join 👉 https://t.me/luckyhacker42 #Joomla #CVE #RCE #InfoSec https://t.co/FVg7UUAfhx
‼️CRITICAL VULNERABILITY ALERT — JOOMLA JCE A post by UNDERGROUND-NET highlights CVE-2026-48907, an alleged Remote Code Execution (RCE) vulnerability affecting the JCE editor extension for Joomla versions prior to 2.9.99.5. Reported vulnerability: ▪️ CVE: CVE-2026-48907 ▪️ Component: JCE Editor for Joomla ▪️ Attack vector: Unauthenticated profile creation ▪️ Potential impact: PHP code upload and remote execution on vulnerable servers ⚠️ Risk: If confirmed and exploitable, attackers could compromise affected websites, modify content, or gain further access to the hosting environment. Recommended actions: ▪️ Verify the advisory and affected versions with official sources. ▪️ Update JCE to a confirmed fixed version. ▪️ Restrict editor-profile creation and file uploads. ▪️ Monitor server logs for suspicious requests and unexpected PHP files. Status: The vulnerability details require independent verification. Validate only in authorized environments. #CVE202648907 #Joomla #RCE #Vulnerability #WebSecurity #CyberSecurity
[Critical 10.0 CVE-2026-48907] Unauthenticated RCE in the Joomla Content Editor extension 🤯🔥 🔗 https://github.com/gh1mau/masta-cve-2026-48907 🔗 https://www.cve.org/CVERecord?id=CVE-2026-48907 🔗 https://github.com/advisories/GHSA-c3f5-4g7f-qjqj 🔗 https://www.yeswehack.com/news/rce-joomla-content-editor-extension Join team 👉https://t.me/luckyhacker43 https://t.co/lKWhrup20S
Post summary
The post announces a proof‑of‑concept exploit for CVE‑2026‑48907, an unauthenticated RCE in Joomla, but it does not report active exploitation or provide patch details.
🚨 New critical improper access control vulnerability tagged CVE-2026-48907, affecting Widget Factory Joomla Content Editor is seeing active exploitation in the wild as reported by CISA. Vulnerability detection script available below: https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-48907.yaml https://t.co/WZscHir9Dm
Post summary
CISA reports CVE-2026-48907 is actively exploited in the wild, a detection script is available, but no patch or exploit code is referenced.
🚨 A Joomla flaw is now on CISA’s exploited bug list. CVE-2026-48907 has a max CVSS score of 10.0 and can let attackers upload and run PHP code through JCE editor profiles. Affected versions: 1.0.0 through 2.9.99.4 Fixed in: 2.9.99.5 Details here: https://thehackernews.com/2026/06/cisa-warns-of-actively-exploited-joomla.html
Post summary
The post reports that Joomla CVE-2026-48907 is now on CISA’s exploited bug list, confirming active exploitation in the wild. It notes the vulnerability allows PHP code upload via JCE editor profiles, with a patch available in version 2.9.99.5.
🚨 Critical 10.0 CVE-2026-48907 Unauthenticated RCE discovered in the Joomla Content Editor extension. 🤯🔥 PoC, advisory & technical breakdown are out. 🔗 Full analysis + resources 👇 📲 Telegram: https://t.me/luckyhacker43 #CyberSecurity #BugBounty #Joomla #CVE #InfoSec #RCE https://t.co/K9XSxCADBl
Post summary
The post announces the release of a PoC and technical analysis for CVE-2026-48907, a critical unauthenticated RCE in Joomla’s Content Editor.
Joomla Extension - Remote Code Execution in JCE extension for Joomla < 2.9.99.5 CVE: CVE-2026-48907 PT ID: PT-2026-46908 Vendor: Joomla Product: Joomla Content Editor (JCE) extension for Joomla CVSS: 10 Credits: David Jardin Description: A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2026-48907 • https://www.joomlacontenteditor.net/ PoC/Exploit: https://github.com/ywh-jfellus/CVE-2026-48907 #dbugs_vuln
Post summary
CVE-2026-48907 is a critical remote code execution flaw in Joomla's JCE extension, permitting unauthenticated users to upload and execute PHP code; a publicly available PoC exploit has been released.
🛡️ We added Widget Factory Joomla Content Editor improper access control vulnerability CVE-2026-48907 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/w5EVgq2pJ7
Post summary
The tweet announces that CVE-2026-48907, an improper access control issue in Widget Factory Joomla Content Editor, has been added to the KEV Catalog and directs readers to a link to apply mitigations.
‼️ Pre-Auth RCE in Joomla Content Editor: Profile Import to PHP Execution (CVE-2026-48907) https://darkwebinformer.com/pre-auth-rce-in-joomla-content-editor-profile-import-to-php-execution-cve-2026-48907/
Post summary
A pre-authenticated remote code execution vulnerability (CVE‑2026‑48907) affecting Joomla Content Editor’s profile import has been disclosed, providing technical details but no evidence of exploitation or patches yet.
Last week we added scanning for Joomla JCE editor extension CVE-2026-48907 vulnerable instances. This RCE vulnerability is exploited in the wild & on @CISACyber KEV. 4840 vulnerable instances seen 2026-06-22 down from 5146 on 2026-06-19. Top affected: US https://dashboard.shadowserver.org/statistics/combined/map/?date_range=1&map_type=std&source=http_vulnerable&source=http_vulnerable6&tag=cve-2026-48907%2B&data_set=count&scale=log&auto_update=on https://t.co/wzIYX5f17W
Post summary
CVE-2026-48907, a remote code execution flaw in Joomla JCE editor, is actively exploited in the wild as noted on the CISA KEV and is currently affecting thousands of instances.
今日は外向きの資産がまとめて殴られた一日だ。CMS、VPN機器、npmの依存、自治体系サイトまで。守る側が境界の内側だけ見ている隙に、攻撃は全部公開面から入ってくる。 ・Joomla JCE CVE-2026-48907、CVSS10.0の無認証RCEをCISAがKEV追加 ・FortiBleed、Fortinet約7万4千台のVPN認証情報が流出 ・Mastra npm140超パッケージ汚染、dayjs偽装のeasy-day-jsで認証情報窃取 ・神姫バス公式サイトがDDoSで終日閲覧不能、個人情報漏えいは未確認 君の組織の公開資産、最後に棚卸ししたのはいつだ。境界の内側だけ固めて『異常なし』と書いていないか？外から殴られて初めて気付くのが一番高くつく。
Post summary
The tweet highlights several publicly exposed assets exploited by attackers, with CISA designating CVE‑2026‑48907 as a known active exploit, underscoring current attack activity.
NC4, (@NACSAmalaysia), has observed multiple attacks and incidents involving CVE-2026-48907, a critical improper access control vulnerability (CWE-284) in the Joomla Content Editor (JCE) extension for Joomla https://www.nc4.gov.my/alertAdvisory-detail/NC4-ALR-2026-000004
Post summary
The advisory notes that CVE-2026-48907, a critical improper access control flaw in Joomla’s JCE extension, is being actively exploited in multiple attacks, though no PoC, exploit code, or patch information is provided.
Rapid reaction gets you ahead. 6 days before CISA added CVE-2026-48907, a critical Remote Code Execution vulnerability in Joomla Content Editor (JCE), to KEV. watchTowr clients were aware of their exposure. Reach out via our website if you need support. https://t.co/dE6BOUsM1C
Post summary
The tweet highlights that a critical RCE in Joomla's JCE was added to CISA's KEV list, implying active exploitation and encouraging clients to seek support.
Saldırganların WordPress, Joomla gibi sistemlere saldırırken kullandığı CVE'ler : – CVE-2026-3844 (WordPress Breeze) – CVE-2026-48907 (Joomla JCE) Diğerleri: CVE-2026-1969, CVE-2026-3300, CVE-2026-0740, CVE-2026-6433, CVE-2025-7443, CVE-2025-7852, CVE-2025-12057, CVE-2020-36847 ve CVE-2020-25213
Post summary
The text enumerates several CVEs reportedly used for attacks against WordPress and Joomla, but it offers no details on vulnerability specifics, PoCs, exploits, or mitigations.
🚨 CVE-2026-48907 — JoomlaSniper v1.0 released Unauthenticated RCE in Joomla JCE Editor (≤2.9.99.4) CVSS 10.0 • Affects ALL production versions File upload → PHP execution in /tmp/ — no auth required 🔗 http://github.com/ynsmroztas/JoomlaSniper #BugBounty #RCE #Joomla #CVE --- 🧵 2/3 Tool features: ✅ Dual vector (tmp/ + JCE browser) ✅ Interactive shell ✅ Zero dependencies (stdlib only) ✅ Pipeline: subfinder | httpx | JoomlaSniper ✅ Multi-function fallback (shell_exec → system → passthru) ✅ Auto store code detection Fixed in JCE 2.9.99.5 --- 🧵 3/3 Quick test: python3 http://JoomlaSniper.py -u https://target.com --shell Subdomain tarama: subfinder -d http://target.com | httpx -silent | python3 http://JoomlaSniper.py ⚠️ Authorized testing only #BugBounty #InfoSec #RedTeam #AppSec #bugbountytip #bugbountytips #infosec #recon
Post summary
The tweet announces the release of JoomlaSniper v1.0, a proof‑of‑concept tool for an unauthenticated RCE in Joomla JCE Editor, provides usage details and a GitHub link, and notes the patch version that fixes the issue.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | widgetfactorylimited | jce | - | joomla\! | - |