CISA KEV Alert: Joomla iCagenda and Balbooa Forms Zero-Days Enable Unauthenticated RCE

CISA has added two maximum-severity Joomla extension flaws to its Known Exploited Vulnerabilities catalog after both were exploited as zero-days in the wild. CVE-2026-48939 in iCagenda and CVE-2026-56291 in Balbooa Forms both score 10.0 on the CVSS scale. Consequently, federal agencies must patch by July 13, 2026.

What Happened: CISA KEV Alert for Two Joomla Zero-Day Flaws

On July 10, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a binding directive. Two critical vulnerabilities in popular Joomla extensions were added to the Known Exploited Vulnerabilities (KEV) catalog. Furthermore, active exploitation had already been confirmed.

CVE-2026-48939 affects the iCagenda event calendar extension for Joomla. It allows unauthenticated file uploads via the frontend event submission form. On Joomla 6, this leads directly to remote code execution. CVE-2026-56291 targets the Balbooa Forms extension. It also permits unauthenticated file uploads, resulting in remote code execution. Both flaws were discovered after live attacks were observed.

Moreover, the Australian Cyber Security Centre (ACSC) warned that these vulnerabilities are part of a broader global campaign targeting content management systems. Malicious actors are actively scanning for CMS flaws to deploy web shells at scale.

Technical Details of the iCagenda and Balbooa Forms Vulnerabilities

CVE-2026-48939 resides in iCagenda’s “Submit an Event” functionality. An attacker can upload a malicious PHP file through the attachment feature without logging in. On Joomla 6 versions 6.0.0 through 6.1.1, Joomla’s core does not block unsafe uploads by default. Therefore, the uploaded shell executes immediately.

According to mySites.guru, automated scanners identifying themselves as “icagenda-batch/1.0” have been exploiting this flaw since June 15, 2026. The bot grabs a token, uploads a malicious file, and fetches the planted shell from a predictable path.

CVE-2026-56291 works similarly in Balbooa Forms versions up to 2.4.0. The frontend file upload accepted files from anonymous visitors. There was no login requirement, no CSRF token, and no file type check. An attacker could upload a PHP file into a public folder and execute it. MySites.guru discovered this flaw on July 8, 2026, during a live attack on a customer site.

Affected Versions and Scope

• iCagenda CVE-2026-48939: Versions 3.2.1 through 3.9.14 and 4.x through 4.0.7
• Balbooa Forms CVE-2026-56291: Versions up to and including 2.4.0
• Joomla versions at risk for iCagenda RCE: Joomla 6.0.0 through 6.1.1
• All Joomla versions affected by the guest event creation flaw in iCagenda

Business and Operational Impact

These vulnerabilities carry severe consequences for any organization running affected Joomla sites. The flaws allow complete server compromise without authentication. Moreover, the automated nature of the attacks means exploitation happens at scale.

• Full server compromise: Remote code execution grants attackers complete control of the web server
• Data theft: Attackers can access databases, customer records, and confidential files
• Web shell deployment: Compromised servers become persistent backdoors for further attacks
• Defacement and reputation damage: Public sites can be altered or taken offline
• Supply chain risk: Compromised servers can attack visitors or downstream systems
• Compliance implications: Unpatched critical flaws may violate PCI-DSS, HIPAA, or GDPR requirements

For federal agencies, CISA’s BOD 26-04 mandates rapid remediation of KEV-listed vulnerabilities that grant total control after exploitation. The July 13, 2026 deadline leaves no room for delay.

Mitigation and Recommendations

Immediate action is essential for every site running affected extensions. The patches are available and have been publicly confirmed as effective. Therefore, the priority is rapid deployment across all Joomla installations.

Immediate Actions for Defenders

1. Update iCagenda immediately to version 4.0.8 (or 3.9.15 for legacy Joomla 3 sites)
2. Update Balbooa Forms immediately to version 2.4.1
3. Check for compromise indicators after patching, since updates do not clean existing infections
4. Rotate all Joomla admin passwords and database credentials on potentially affected sites
5. Audit the server for unauthorized PHP files, web shells, and suspicious administrator accounts

Compromise Indicators to Check

• Check images/icagenda/frontend/attachments/ for unexpected PHP files
• Check images/baforms/uploads for non-image, non-document files (especially .php)
• Review the Joomla user list for suspicious administrator accounts
• Audit recently modified or unfamiliar PHP files across the entire site
• Review web server access logs for requests from “icagenda-batch/1.0” user agents

Additional Hardening Steps

Furthermore, consider these longer-term measures to reduce similar risks:

• Upgrade to Joomla 6.1.2 or later, which reinstates default blocking of unsafe file uploads
• Implement a Web Application Firewall (WAF) with rules for known CMS exploit patterns
• Enable file upload restrictions at the web server level
• Monitor extension versions centrally if managing multiple Joomla sites
• Subscribe to security advisories from Joomla extension developers

Bottom line: Both CVE-2026-48939 and CVE-2026-56291 are actively exploited, maximum-severity flaws with public patches. Update iCagenda and Balbooa Forms now. Then audit for compromise, because the patch closes the door but does not remove what an attacker already left inside.

Incident Summary

CVE IDs:	CVE-2026-48939 (iCagenda), CVE-2026-56291 (Balbooa Forms)
Severity:	CVSS 10.0 (Critical) for both
Affected Systems:	Joomla sites running iCagenda 3.2.1-4.0.7 or Balbooa Forms up to 2.4.0
Disclosure Date:	July 8-10, 2026 (CISA KEV added July 10, 2026)
Exploitation Start:	June 15, 2026 (iCagenda zero-day), July 8, 2026 (Balbooa Forms)
Patch Status:	Available: iCagenda 4.0.8 / 3.9.15; Balbooa Forms 2.4.1
Federal Deadline:	July 13, 2026 (BOD 26-04)
CISA KEV:	CISA Alert AA26-191A

References

1. The Hacker News, “iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days,” July 13, 2026, https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html (accessed July 13, 2026)
2. U.S. Cybersecurity and Infrastructure Security Agency (CISA), “CISA Adds Two Known Exploited Vulnerabilities to Catalog,” July 10, 2026, https://www.cisa.gov/news-events/alerts/2026/07/10/cisa-adds-two-known-exploited-vulnerabilities-catalog (accessed July 13, 2026)
3. mySites.guru, “Zero Day Vulnerability Found in iCagenda Joomla Extension,” June 15, 2026 (updated July 8, 2026), https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/ (accessed July 13, 2026)
4. JoomliC, “iCagenda Security Update (version 4.0.8),” July 8, 2026, https://www.joomlic.com/news/icagenda-security-update (accessed July 13, 2026)
5. Australian Cyber Security Centre (ACSC), “Large Scale Exploitation Campaign Targeting Website Content Management Systems (CMS),” July 11, 2026, https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/large-scale-exploitation-campaign-targeting-website-content-management-systems-cms (accessed July 13, 2026)