CISA Adds Two Critical Vulnerabilities to Known Exploited Vulnerabilities Catalog
Executive Summary
On July 10, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-48939 and CVE-2026-56291. CVE-2026-48939 is a critical remote code execution vulnerability in the iCagenda extension for Joomla, allowing unauthenticated attackers to upload and execute arbitrary PHP files on the server. CVE-2026-56291 pertains to the Balbooa Forms extension, enabling similar unauthorized file uploads leading to potential server compromise. Both vulnerabilities have been actively exploited in the wild, posing significant risks to organizations using these Joomla extensions.
The inclusion of these vulnerabilities in the KEV Catalog underscores the persistent threat posed by unpatched software components in widely used content management systems. Organizations are urged to prioritize the remediation of these vulnerabilities to prevent potential data breaches and system compromises.
Why This Matters Now
The active exploitation of these vulnerabilities highlights the critical need for organizations to promptly apply security patches to prevent unauthorized access and potential data breaches.
Attack Path Analysis
Attackers exploited vulnerabilities in Joomla extensions to upload malicious PHP files, gaining remote code execution. They escalated privileges by executing the uploaded scripts, enabling full control over the server. Lateral movement was achieved by accessing other systems within the network. Command and control were established through persistent backdoor connections. Data exfiltration occurred via unauthorized data transfers. The attack culminated in significant data loss and service disruption.
Kill Chain Progression
Initial Compromise
Description
Attackers exploited vulnerabilities in Joomla extensions (CVE-2026-48939 and CVE-2026-56291) to upload malicious PHP files, gaining remote code execution.
Related CVEs
CVE-2026-48939
CVSS 9.8An unrestricted file upload vulnerability in the iCagenda extension for Joomla allows unauthenticated remote attackers to execute arbitrary code.
Affected Products:
Jooml! Project iCagenda – < 3.9.15
Exploit Status:
exploited in the wildCVE-2026-56291
CVSS 9.8An unrestricted file upload vulnerability in the Balbooa Forms component for Joomla allows unauthenticated remote attackers to execute arbitrary code.
Affected Products:
Balbooa Balbooa Forms – < 2.0.0
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Upload Malware
Ingress Tool Transfer
Exploitation for Client Execution
Exploitation for Credential Access
Exploitation for Defense Impairment
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Maintain secure systems and applications
Control ID: 6.4.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Identity
Control ID: Pillar 2
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
Federal agencies face mandatory KEV remediation under BOD 26-04, with unrestricted file upload vulnerabilities creating critical attack vectors for total system compromise.
Information Technology/IT
IT service providers managing web applications with forms and calendar systems face elevated risk from file upload exploitation requiring immediate vulnerability patching.
Health Care / Life Sciences
Healthcare organizations using vulnerable web components risk HIPAA compliance violations through unrestricted file uploads enabling lateral movement and data exfiltration.
Financial Services
Financial institutions face regulatory compliance risks from file upload vulnerabilities that could enable privilege escalation and compromise customer data protection requirements.
Sources
- CISA Adds Two Known Exploited Vulnerabilities to Cataloghttps://www.cisa.gov/news-events/alerts/2026/07/10/cisa-adds-two-known-exploited-vulnerabilities-catalogVerified
- NVD - CVE-2026-48939https://nvd.nist.gov/vuln/detail/CVE-2026-48939Verified
- NVD - CVE-2026-56291https://nvd.nist.gov/vuln/detail/CVE-2026-56291Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have significantly limited the attacker's ability to move laterally, escalate privileges, and exfiltrate data by enforcing strict segmentation and identity-aware policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to execute unauthorized code on the server would likely be constrained, reducing the risk of initial compromise.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges would likely be constrained, reducing the risk of gaining full control over the server.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally within the network would likely be constrained, reducing the risk of accessing other systems.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish persistent backdoor connections would likely be constrained, reducing the risk of maintaining control over compromised systems.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data would likely be constrained, reducing the risk of unauthorized data transfers.
The attacker's ability to cause significant data loss and service disruption would likely be constrained, reducing the risk of severe operational impact.
Impact at a Glance
Affected Business Functions
- Website Content Management
- Online Event Registration
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of user registration data and event details.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict lateral movement within the network.
- • Deploy Inline IPS (Suricata) to detect and prevent malicious file uploads.
- • Utilize Cloud Firewall (ACF) to control and monitor outbound traffic, preventing unauthorized data exfiltration.
- • Enhance Threat Detection & Anomaly Response capabilities to identify and respond to suspicious activities promptly.
- • Regularly update and patch all software components to mitigate known vulnerabilities.
