SECURITYJun 17 · 05:50 UTCTHE HACKER NEWS[email protected] (The Hacker News)

CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution

CISA added a maximum-severity vulnerability in Joomla JCE to its KEV catalog, citing active exploitation. The flaw, CVE-2026-48907 with a CVSS score of 10.0, involves improper access control allowing arbitrary PHP code execution.

Nexus surfaces and summarizes. The full story lives at the source.

Mentioned

U.S. Cybersecurity and Infrastructure Security AgencyorganizationJoomla JCEtopicCVE-2026-48907topicCVSS scoretopicKnown Exploited Vulnerabilities (KEV) catalogtopic

Spot something wrong with this article?Report a problem →

Forward this

Related Signal

Adjacent reporting

SECURITYJun 6 · 08:14 UTC
CISA Adds Actively Exploited SolarWinds Serv-U DoS Flaw to KEV Catalog
SECURITYJun 9 · 06:26 UTC
LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE
SECURITYMay 23 · 07:23 UTC
Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV
SECURITYJun 4 · 07:19 UTC
CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog
SECURITYMay 3 · 06:26 UTC
CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV