CVE-2026-48907criticalunder attackCWE-284

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 10epss 56%

from disclosure to weapon4 days

Published on NVDJun 5

1st PoC+4d

metasploitJun 5

CISA KEV+11d

exploitation probability

56%top 1% of all CVEs

observed exploitation

yesCISA + VulnCheck

34 public exploit(s)

Action required by CISAfederal deadline: 2026-06-19

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Researched and written with AI from the vendor advisory and public analysis, with the sources above. Always confirm the fixed version in the official advisory before acting.

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red

Affected products

joomlacontenteditor.net · Joomla Content Editor (JCE) extension for Joomla

public PoCs found — 34

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48907 https://www.joomlacontenteditor.net/https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites