A zero-day rated at the absolute top of the severity scale is now the most urgent patch item on the internet. On June 16, 2026, the Cybersecurity and Infrastructure Security Agency added CVE-2026-48907 to its Known Exploited Vulnerabilities catalog, a flaw in the Widget Factory JCE (Joomla Content Editor) plugin that scores a perfect CVSS 10.0. CISA gave federal civilian agencies until Friday, June 19, 2026, to patch it. For the estimated 2.5 million active Joomla sites running the plugin worldwide, the clock is already running, and attackers do not need a password to start the timer.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Is CVE-2026-48907? Inside the Joomla JCE Zero-Day
CVE-2026-48907 is tracked under CWE-284, Improper Access Control, and it lives in one of the most widely installed content-editor extensions in the Joomla ecosystem. In plain terms, JCE lets an unauthenticated visitor send a single HTTP request and create a brand-new editor profile configured to accept executable file uploads. No login, no session cookie, no prior foothold on the site. From there, planting a PHP webshell and running it takes seconds.
The maximum score is not marketing. CVSS 10.0 requires an attack that needs no privileges, no user interaction, and delivers a complete compromise of confidentiality, integrity, and availability. CVE-2026-48907 checks every one of those boxes. Researchers who broke down the bug describe it as a three-part failure: no authentication check on the profile-creation endpoint, no validation of the file extension being uploaded, and an upload flag that never should have defaulted to permissive. Any single piece would be a moderate bug. Stacked together, they produce full remote code execution in a plugin that ships as a near-default choice for Joomla’s built-in editor.
Anatomy of the Exploit: From Rogue Editor Profile to Full Server Takeover
The attack path is short enough to automate at scale, which is exactly what is happening. A request lands at index.php?option=com_jce&task=profiles.import with no authentication attached. JCE creates the profile anyway. The attacker points that profile at an upload directory, typically inside images/ or a temporary folder, and drops a PHP file disguised as media. One more request executes it. At that point the intruder has the same file-system access as the web server process, which on most shared and managed hosting environments is enough to read configuration files, pull database credentials, and pivot into every other site on the same box.
What makes this chain dangerous for defenders is that closing the hole does not undo damage already done. Patching stops new intrusions through that specific door. It does nothing to remove a webshell an attacker planted last week, a rogue admin account created last month, or credentials already stolen. That distinction drives everything in the detection section below, and skipping it is the single most common mistake site owners make after a critical CVE like this one: they patch, breathe a sigh of relief, and never check whether they were already compromised.
CISA’s Emergency Order: Federal Agencies Have Until June 19
CISA’s Known Exploited Vulnerabilities catalog exists to flag bugs that have stopped being theoretical. Once a CVE lands on that list, Binding Operational Directive 26-04 gives federal civilian executive branch agencies a fixed window to patch, and CISA set the deadline for CVE-2026-48907 at June 19, 2026, just three days after the KEV listing. That is an unusually tight window even by KEV standards, and it reflects both the maximum severity score and the fact that working exploit code is already public.
The directive only binds federal civilian agencies directly. State governments, universities, and small businesses running a Joomla brochure site face no legal requirement to hit that date. In practice, security teams everywhere treat KEV deadlines as a forcing function regardless of whether the mandate technically applies to them, because a KEV listing is one of the more reliable public signals that a bug has moved from “patch when convenient” to “patch today.”
Timeline: How a Silent June 3 Patch Became a KEV Emergency
Widget Factory shipped the first fix, version 2.9.99.5, on June 3, 2026, without the kind of loud disclosure that usually accompanies a maximum-severity bug. A hardened follow-up, version 2.9.99.6, arrived three days later on June 6 with additional checks the developers apparently decided the first patch had not fully covered. Then, ten days after that, CISA confirmed active exploitation and added CVE-2026-48907 to its KEV catalog on June 16. Thirteen days from a quiet patch to a federal emergency order is fast, and it is becoming a pattern this year. Several CVEs Tech Insider has already covered, from the Windows Netlogon flaw to the SharePoint RCE bug, followed a similar arc: a quiet patch first, then rapid escalation once exploitation was confirmed in the wild.
For Joomla site owners who check release notes irregularly, or not at all, this timeline carries the real lesson. There was a two-week gap between a fix being available and the vulnerability becoming a five-alarm story, and attackers spent that window scanning.
Who’s Affected: 2.5 Million Joomla Sites in the Blast Radius
JCE ranks among the most widely installed content-editor extensions in the Joomla ecosystem, bundled or recommended on a large share of production sites. Automated scanning campaigns are currently probing an estimated 2.5 million active Joomla installations worldwide for the vulnerable endpoint, according to threat intelligence published by Beazley Security. Every version from 1.0.0 through 2.9.99.4 is exposed, a range covering more than a decade of releases, including the still-common 2.7.x and 2.8.x branches that many agencies and small businesses never got around to retiring.
Unlike flaws that need a specific server configuration or an unusual plugin combination to trigger, this one only needs JCE installed and reachable over HTTP. No login, no social engineering, no dependency on a second bug. That is exactly the profile CISA’s KEV catalog is built to catch early, and exactly the profile that turns into mass exploitation within days once public exploit code exists, which it now does.
How to Patch and Mitigate CVE-2026-48907
Updating to JCE 2.9.99.6
The fix is version 2.9.99.6, and Widget Factory recommends it over 2.9.99.5 specifically because of the extra hardening added three days after the initial patch. For sites on modern stacks, Joomla’s Extension Manager handles the update in a couple of clicks. Sites still running older PHP versions or a Joomla 3.x branch that cannot take the latest JCE release should apply the standalone patch Widget Factory published for legacy 2.7.x and 2.8.x installs, since a full version jump is not always realistic on short notice.
Mitigation If You Can’t Patch Immediately
Not every organization can push an emergency change through in the next 24 hours. If patching has to wait, four steps cut exposure substantially.
- Disable the JCE extension entirely if it is not business-critical.
- Block executable file types, including .php, .pht, and .phtml, at the web server or WAF layer for any upload-handling path.
- Restrict or firewall access to the com_jce component’s profile-related endpoints.
- Check the JCE editor profile list for anything an administrator does not recognize, since a rogue profile is the first fingerprint this exploit leaves behind.
Detecting Compromise Before and After Patching
Auditing Editor Profiles and Uploaded Files
A patched site can still be a compromised site. Before declaring the job done, administrators should open Components, then JCE Editor, then Editor Profiles, and delete anything unfamiliar. Next, search the images/ directory and any writable upload path for PHP files that have no business being there. Log review narrows the window further: search web server access logs for POST requests to the profile-import endpoint, especially from IP ranges that have no reason to be creating editor profiles on the site.
# Search access logs for exploitation attempts against
# the vulnerable JCE profile-import endpoint
grep "com_jce&task=profiles.import" /var/log/apache2/access.log
# Confirm the installed JCE version from the Joomla CLI
php cli/joomla.php extension:list --search="Content Editor"
# List PHP files written recently to common upload paths
find images/ tmp/ -name "*.php" -mtime -30 -lsIf any of those checks turn up something, the honest response is a full incident response cycle, not a quick delete. That means rotating admin, database, and FTP or SFTP credentials, especially any that are reused elsewhere, and running a complete server-side malware scan rather than assuming one webshell was the only thing planted.
CVE-2026-48907 by the Numbers
The table below collects the core facts security teams need to brief leadership or a customer on short notice.
| Detail | Data |
|---|---|
| CVE ID | CVE-2026-48907 |
| CVSS Score | 10.0 (Maximum/Critical) |
| Weakness Type | CWE-284, Improper Access Control |
| Affected Product | Widget Factory JCE (Joomla Content Editor) plugin |
| Affected Versions | 1.0.0 through 2.9.99.4 |
| Patched Versions | 2.9.99.5 (June 3, 2026, the first fix (version 2.9.99.5) was released; the hardened version 2.9.99.6 was released on June 6, 2026.9.99.6 (June 6, 2026) |
| Added to CISA KEV Catalog | June 16, 2026 |
| Federal Patch Deadline | June 19, 2026, under BOD 26-04 |
| Estimated Sites Targeted | Approximately 2.5 million active Joomla installations |
| Exploitation Status | Actively exploited; public exploit code available |
How CVE-2026-48907 Stacks Up Against 2026’s Other Critical CVEs
A perfect CVSS score is rare enough that it is worth measuring against the rest of a year that has already produced several critical, unauthenticated bugs in widely used software. CVE-2026-48907 is not an outlier in frequency, three other maximum or near-maximum severity flaws have driven federal patch deadlines in 2026 alone, but it is an outlier in how quickly it moved from a quiet patch to a KEV emergency.
| CVE / Flaw | Affected Product | CVSS Score | Notable Detail |
|---|---|---|---|
| CVE-2026-48907 | Joomla JCE plugin | 10.0 | KEV-listed 13 days after first patch; federal deadline June 19, 2026 |
| CVE-2026-41089 | Windows Netlogon | 9.8 | Directly compared to 2020’s Zerologon flaw in scope and impact |
| CVE-2026-45659 | Microsoft SharePoint | 8.8 | Federal patch deadline set for July 4, 2026 |
| Cisco SD-WAN flaws (2 of 7 disclosed) | Cisco SD-WAN | 10.0 | Part of a batch of seven zero-days disclosed together |
| CVE-2020-1472 (Zerologon) | Windows Netlogon (legacy) | 10.0 | 2020-era benchmark for unauthenticated, maximum-severity bugs |
Historical Context: Zerologon, SQL Injection, and the CMS Zero-Day Pattern
A maximum CVSS score is rare enough that each new one draws comparisons to the last. The most famous 10.0 in recent memory is Zerologon, CVE-2020-1472, the Windows Netlogon flaw Secura researchers disclosed in 2020 that let attackers impersonate domain controllers with zero credentials. It became the reference point for what an unauthenticated, maximum-severity bug can do to an entire network once exploited at scale, and Tech Insider’s own coverage of this year’s new Netlogon-adjacent flaw reached for the same comparison.
Joomla itself is no stranger to critical bugs. CVE-2025-25257, an unauthenticated SQL injection in Joomla’s core, sits in the same general neighborhood of “no login required” severity, though without the direct path to code execution that makes CVE-2026-48907 worse in practice. The pattern across both incidents, and across the wider run of 2026 disclosures, from Cisco’s SD-WAN zero-days to the CitrixBleed-style NetScaler flaw, is that CMS platforms and network-edge software keep producing bugs that skip authentication entirely. That is the exact category CISA’s KEV catalog was built around, and 2026 has kept it busy.
Market Impact: What This Means for the CMS Security Industry
Joomla holds a smaller share of the CMS market than WordPress, but a 2.5 million-site install base is still large enough to matter to hosting providers, managed-security vendors, and the extension marketplace built around the platform. Expect a short-term spike in demand for managed Joomla hosting with automatic patching, since the gap between a patch shipping and a patch actually being applied is exactly where this incident did its damage. Extension developers across the ecosystem are also facing renewed pressure to adopt stricter upload validation by default rather than leaving it configurable, a lesson WordPress’s plugin review process learned the hard way after its own string of upload-related remote code execution bugs.
There is a reputational cost too. JCE has been a trusted, widely recommended extension for years. A 10.0 bug in a plugin that popular does not just affect the sites running it. It reopens the broader argument about how much scrutiny third-party CMS extensions receive before they get recommended as defaults, an argument that flares up every time a plugin ecosystem produces a bug this severe.
Industry Reaction: What Security Researchers Are Saying
Beazley Security’s threat intelligence team flagged the KEV listing as confirmation that automated scanning campaigns were already targeting the full population of exposed Joomla sites, not a narrow or targeted set of victims. A separate analysis published by CloudKey Tech reached the same conclusion from a different angle, pointing out that public exploit code combined with a KEV addition just 13 days after the first patch made mass exploitation close to inevitable rather than a remote possibility. Threat research from Mallory.ai made the point defenders most need to hear: applying the update blocks new intrusions through that specific path, but it does not remove any persistence, webshells, or malware attackers may have already planted before the patch went in.
None of the public analysis so far names a specific threat actor or coordinated campaign behind the exploitation. That fits how these mass, unauthenticated CMS bugs typically play out. Opportunistic scanning by many unrelated actors, rather than one coordinated group, tends to be the pattern once exploit code goes public, and the resulting scan volume is usually what forces a KEV listing in the first place.
Predictions: Where the Joomla JCE Fallout Goes Next
- Exposure telemetry goes public within weeks. Internet-scanning projects typically publish compromise counts after a KEV listing this size, and CVE-2026-48907’s 2.5 million-site exposure window makes it a likely candidate for a follow-up report.
- A second wave of “patched but still compromised” incidents surfaces through mid-to-late summer 2026. Smaller sites will update the plugin without ever checking for a planted webshell first, and some of those sites will resurface in breach reports months later.
- Extension marketplaces face renewed calls for mandatory security review before shipping upload functionality. Joomla’s ecosystem, and by association WordPress’s, will see the same debate that follows every major CMS plugin RCE wave.
- JCE likely needs at least one more hardening release. The first patch, 2.9.99.5, already required a follow-up within three days, and bugs of this shape often produce a second round of edge-case fixes once wider testing begins.
- Non-federal organizations keep adopting KEV deadlines as internal policy. State agencies, universities, and enterprises with no legal obligation under BOD 26-04 have already started treating CISA’s deadlines as their own benchmark, a trend visible in how fast non-federal teams reacted to this year’s SharePoint and Netlogon patch windows.
What Joomla Administrators Should Do Right Now
- Update to JCE 2.9.99.6 today, not later this week.
- Audit the editor profile list for anything unrecognized.
- Scan upload directories for PHP files that should not be there.
- Rotate admin, database, and FTP credentials if any audit step turns up something unexpected.
- Review server logs for POST requests to the vulnerable endpoint going back to at least June 3, 2026.
- If running an older PHP version or a Joomla 3.x branch, apply the standalone patch rather than waiting on a full upgrade.
Frequently Asked Questions
What is CVE-2026-48907?
It is a maximum-severity, CVSS 10.0 vulnerability in the Widget Factory JCE plugin for Joomla. It lets an unauthenticated attacker create a rogue editor profile and upload a PHP webshell, resulting in full remote code execution.
Is my Joomla site affected by CVE-2026-48907?
Any site running the JCE plugin at version 2.9.99.4 or earlier is affected, a range that spans versions 1.0.0 through 2.9.99.4. Check your installed version through the Joomla Extension Manager.
How do I patch CVE-2026-48907?
Update to JCE version 2.9.99.6, which includes the hardened fix. Sites unable to move to the latest version should apply Widget Factory’s standalone patch for legacy 2.7.x and 2.8.x installs.
Does patching remove a webshell an attacker already planted?
No. Patching closes the entry point but does not remove existing malware, rogue accounts, or stolen credentials. A separate audit of editor profiles, upload directories, and server logs is required after patching.
Why did CISA give federal agencies only three days to patch?
The short window reflects the maximum CVSS 10.0 score, confirmed active exploitation, and the availability of public exploit code, all factors that push a KEV deadline toward the shortest end of CISA’s typical range.
Is CVE-2026-48907 being actively exploited right now?
Yes. CISA confirmed active exploitation before adding it to the KEV catalog, and automated scanning campaigns are targeting the estimated 2.5 million active Joomla sites worldwide.
How does CVE-2026-48907 compare to Zerologon?
Both carry a CVSS 10.0 score and require no authentication. Zerologon (CVE-2020-1472) targeted Windows domain controllers in 2020, while CVE-2026-48907 targets a Joomla plugin in 2026. Both became reference points for what an unauthenticated, maximum-severity bug can do at scale.
What if I can’t patch immediately?
Disable the JCE extension if possible, block executable file uploads at the server or WAF layer, restrict access to the affected component’s endpoints, and check for rogue editor profiles until a full update can be applied.
Related Coverage
- Windows Netlogon Flaw Beats Zerologon: CVSS 9.8 [2026]
- SharePoint RCE Exploited: CVSS 8.8, July 4 Deadline [2026]
- New CitrixBleed Flaw: NetScaler Hit in 24 Hours [2026]
- Cisco SD-WAN: 7 Zero-Days, 2 at CVSS 10 [2026]
- Adobe ColdFusion Zero-Day Exploited Within 2 Hours [2026]
- Klue Breach Hits 200 Firms via 4-Year-Old Credential [2026]
- Wazuh SIEM Setup With Docker: 14 Steps, 60 Min [2026]
More cybersecurity coverage is available in Tech Insider’s cybersecurity section.
Sources and further reading: CVE.org record for CVE-2026-48907, NVD vulnerability detail, MITRE’s CWE-284 definition, Joomla release announcements, OWASP’s vulnerability resource library, and the FIRST.org CVSS 4.0 calculator used to score the flaw.
