VulnSocial

CVE-2026-65884Disclosure(balbooa / gridbox)

MEDIUMCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

  • Patch balbooa gridbox systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions.

balbooa CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-284

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • gridbox

Threat summary

  • Active exploitation appears in 2 classified signals
  • Patch or workaround signal is available
  • 5 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 2 signals
  • Patch or workaround mentioned in 4 signals
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • Peaked 2d ago at 3 mentions (2026-07-29); latest day: 1
  • 5 total mentions across 3 days

Affected systems

Vendors
balbooa
Products
gridbox

Deep dive

Activity timeline5 mentions / 3d
01223Mentions · 2026-07-29: 3Mentions · 2026-07-30: 1Mentions · 2026-08-01: 1Active Exploitation · 2026-07-30: 1Active Exploitation · 2026-08-01: 1Patch / Workaround · 2026-07-29: 2Patch / Workaround · 2026-07-30: 1Patch / Workaround · 2026-08-01: 1Technical Details · 2026-07-29: 2Technical Details · 2026-07-30: 1Technical Details · 2026-08-01: 107-2907-3008-01
Signal classification3 categories
Disclosure
240.0%
Active Exploitation
240.0%
Patch
120.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-07-293
Disclosure2Patch1
2026-07-301
Active Exploitation1
2026-08-011
Active Exploitation1
Full discourse5 posts
  • CCB Alert@CCBalert
    Active Exploitation

    Warning: Multiple critical vulnerabilities in the #Gridbox plugin for #Joomla CVE-2026-65884 CVSS: 10. These can lead to #RCE and allow attackers to create an admin account. Some are #ActivelyExploited ! See https://www.balbooa.com/blog/gridbox/gridbox-2-20-2-security-release and https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/ #Patch #Patch #Patch

    Post summary

    The Gridbox plugin for Joomla has multiple critical RCE vulnerabilities (CVE-2026-65884) that are reportedly being actively exploited; patch releases are available and mentioned in the linked blog posts.

    01010359
    7.2K followersView on X
  • SecAlerts@SecAlertsCo
    Active Exploitation

    🔓 Unauthenticated privilege escalation in Gridbox (Joomla) — attackers supply arbitrary usergroup IDs at registration. CVE-2026-65884 scores CVSS 10 with active exploitation. Update to 2.20.2+ now. #cybersecurity #ciso #vulnerabilities #mssp https://secalerts.co/vulnerability/CVE-2026-65884?utm_campaign=x https://t.co/DSIwEqBuZm

    Post summary

    Gridbox (Joomla) suffers from an unauthenticated privilege escalation (CVE‑2026‑65884) due to arbitrary usergroup IDs during registration; the vulnerability is rated CVSS 10, actively exploited in the wild, and a patch (2.20.2+) has already been released.

    00010256
    871 followersView on X
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨Critical - Joomla Gridbox Admin Account Creation via usergroup ID Tampering (CVE-2026-65884) http://balbooa.com Gridbox (com_gridbox) registration endpoint trusts user-supplied usergroup IDs during signup, allowing unauthenticated attackers to select an Administrator group and create a new admin account. Leads to full site takeover. Instances with public registration disabled are not impacted. 👉Affected: Joomla com_gridbox < 2.20.2 | Upgrade to 2.20.2

    Post summary

    A critical Joomla Gridbox vulnerability (CVE‑2026‑65884) permits unauthenticated creation of admin accounts via usergroup ID tampering; upgrading to version 2.20.2 resolves the issue.

    0001069
    274 followersView on X
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨Critical - Joomla Gridbox Authenticated Arbitrary File Upload (CVE-2026-65885) Balbooa Gridbox (Joomla component com_gridbox) allows authenticated users to upload arbitrary files via its upload handler without strict extension/path validation. Chained with CVE-2026-65884 to obtain an account, attackers can drop a PHP webshell and achieve authenticated RCE. 👉Affected: http://balbooa.com Gridbox for Joomla (com_gridbox) versions unknown

    Post summary

    This brief announcement highlights a critical authenticated arbitrary file upload vulnerability in Balbooa Gridbox, detailing how attackers may upload a PHP webshell to achieve authenticated remote code execution.

    0000099
    274 followersView on X
  • PJ@Npj8448
    Patch

    "Ransomware attacks surge with groups like Insomnia, Black X, Section9, and Akira on the rise. Don't forget to patch vulnerabilities like CVE-2026-65885 and CVE-2026-65884 to stay safe! #ThreatIntel #CyberSecurity" https://pranithjain.qzz.io/threatintel/cyberpulse

    Post summary

    The message urges patching of CVE-2026-65885 and CVE-2026-65884 amid rising ransomware activity, but provides no further exploit or technical details.

    0000057
    51 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appbalbooagridbox-joomla\!-

Explore more

Back to dashboardbalbooa CVEsgridbox vulnerabilities