CISA KEV Adds Splunk, Joomla Vulns: Patch By July 3 Deadline

A CVE-2026-48907 vulnerability in the Joomla JCE editor, rated 10.0 CVSS, allows unauthenticated attackers to upload and execute PHP code. This vulnerability, alongside CVE-2026-20253 in Splunk Enterprise, was added to CISA's Known Exploited Vulnerabilities (KEV) Catalog this week, with federal patch mandates of June 19, 2026, and July 3, 2026, respectively. Simultaneously, security researcher Nightmare Eclipse publicly disclosed "RoguePlanet," a new local elevation of privilege zero-day in Microsoft Defender, tracked as CVE-2026-50656, and the Gentlemen ransomware group claims to have disrupted operations at two of Mackay Sugar's three mills in Queensland since June 10.

What Happened

CISA added two critical vulnerabilities to its KEV Catalog this week, indicating active exploitation. On June 17, 2026, CISA added CVE-2026-48907, impacting the Widget Factory Joomla Content Editor (JCE). Federal agencies must patch this by June 19, 2026. This vulnerability, rated 10.0 CVSS by NVD, allows unauthenticated users to upload and execute PHP code, creating persistent web shells. Joomla confirmed active exploitation, public exploit code availability, and automated attacks, as detailed by BleepingComputer. JCE versions 1.0.0 through 2.9.99.4 are affected; a fix is available in JCE 2.9.99.5, released on June 3, 2026.

On June 18, 2026, CISA added CVE-2026-20253, affecting Splunk Enterprise, to the KEV, setting a federal patch deadline of July 3, 2026 (NVD, CISA KEV). This vulnerability involves a critical function lacking proper authentication, which CISA states poses a "significant risk" due to potential unauthorized actions or data compromise. While specific technical details on CVE-2026-20253 are still emerging, its KEV inclusion means active exploitation is a certainty.

Beyond these KEV updates, security researcher Nightmare Eclipse publicly disclosed "RoguePlanet," a local elevation of privilege zero-day in Microsoft Defender, tracked as CVE-2026-50656. Microsoft confirmed the flaw on June 17, 2026, rating it 7.8 CVSS and "Exploitation More Likely." This vulnerability, exploitable with low complexity by authenticated attackers, abuses a race condition to gain SYSTEM privileges on fully patched Windows 10 and 11 devices, as reported by BleepingComputer. Microsoft has not detected any in-the-wild exploitation. Meanwhile, the Gentlemen ransomware group claims to have disrupted operations at two of Mackay Sugar's three mills in Queensland since June 10, impacting Australia's second-largest sugar producer. The group claims to have stolen data and threatens publication if ransom is not paid, but Mackay Sugar has not confirmed data exfiltration nor has it publicly disclosed specific data types or ransom amounts.

Why It Matters

CISA's rapid KEV additions mean these are not theoretical threats; attackers are actively using them against targets right now. Federal agencies have a binding directive, and all other organizations should use these as critical prioritization flags. You cannot afford to ignore these vulnerabilities.

CVE-2026-20253 in Splunk Enterprise is particularly concerning. Splunk often centralizes security operations, aggregating logs and providing critical visibility. An unauthenticated flaw in a "critical function" means attackers could potentially disrupt logging, manipulate data, or gain unauthorized access to sensitive security information. The impact on incident response and compliance could be catastrophic.

The Joomla JCE vulnerability, CVE-2026-48907, with its perfect 10.0 CVSS score, is just as severe. Dropping web shells on a content management system allows full control over the website and potential pivot points into internal networks. Organizations relying on Joomla for public-facing assets face an immediate compromise vector that automated tools are already hitting.

The Microsoft Defender zero-day, CVE-2026-50656, hits at the core of endpoint security. An authenticated attacker gaining SYSTEM privileges on a fully patched machine means a local threat or an attacker who has already gained initial access can easily escalate and take full control. This undermines confidence in core protective measures. The Gentlemen ransomware group's claim of disrupting Mackay Sugar's operations is a tangible example of the operational disruption and financial damage these threats cause to businesses, hitting a company with over $420 million in annual revenue. Mackay Sugar has not confirmed the extent of the disruption.

Affected Scope & Remediation

Organizations running Splunk Enterprise or the Joomla JCE editor must act with extreme urgency. For CVE-2026-20253 in Splunk Enterprise, specific affected versions are not yet fully disclosed by NVD, but the KEV listing indicates all deployments are at risk until official guidance from Splunk clarifies scope. You need to patch Splunk Enterprise CVE-2026-20253 as soon as the vendor advisory and patches are available. CISA has mandated federal agencies to patch by July 3, 2026.

For CVE-2026-48907, affected versions of the JCE editor for Joomla include 1.0.0 through 2.9.99.4. The fix is available in JCE version 2.9.99.5. The federal patch deadline for this is even tighter, June 19, 2026, only two days after its KEV addition. You need to update your JCE installations immediately. If immediate patching isn't possible, consider temporarily disabling the JCE editor or restricting access to it until you can apply the patch. Detect exploitation by checking for suspicious editor profiles and auditing web server access logs for unauthenticated requests to the profile import task (index.php?option=com_jce&task=profiles.import). Endpoint detection and response tools like CrowdStrike Falcon or SentinelOne can help detect anomalous activity indicating compromise.

The Microsoft Defender zero-day, CVE-2026-50656, affects fully patched Windows 10 and 11 devices. As of writing, Microsoft is still working on a patch; there are no public workarounds. Organizations should monitor Microsoft's MSRC advisories closely for updates and prepare to deploy the patch as soon as it's released.

Key Links:

• CVE-2026-20253 (Splunk): NVD Entry, CISA KEV (Federal Deadline: July 3, 2026)
• CVE-2026-48907 (Joomla JCE): NVD Entry, CISA KEV (Federal Deadline: June 19, 2026)
• CVE-2026-50656 (Microsoft Defender): NVD Entry

The JCE patch (2.9.99.5) was released on June 3, 2026, a full 14 days before CISA added it to the KEV catalog, demonstrating the urgency for prompt patching even before a federal mandate.

Technical Breakdown

The Joomla JCE vulnerability, CVE-2026-48907, is an improper access control flaw in the editor's profile import function. Imagine a guarded gate where visitors typically show ID. This vulnerability is like finding a hidden side door that completely bypasses the guard and lets anyone walk directly into the secure area. In this case, the "secure area" is the ability to upload and execute code. Unauthenticated attackers exploit this by crafting a "rogue editor profile" — essentially a malicious configuration file — and importing it. This process drops a web shell, typically a PHP script, onto the server. Once the web shell is in place, attackers gain persistent remote code execution, effectively having a backdoor to the web server and the Joomla instance. This aligns with T1190 Exploit Public-Facing Application for initial access, T1105 Ingress Tool Transfer for dropping the web shell, and T1547 Boot or Logon Autostart Execution for maintaining persistence through the web shell. Implementing SI-10 Information Input Validation and AC-3 Access Enforcement would have prevented this, and RA-5 Vulnerability Monitoring and Scanning should detect it quickly.

For CVE-2026-20253 in Splunk Enterprise, the "Missing Authentication for Critical Function" classification implies a dangerous gap in security. Imagine a bank vault that requires multiple keys and biometric scans for access, but a key component of the vault door mechanism itself doesn't actually check any of those authentication factors. An attacker could directly manipulate this component without providing credentials. This allows them to bypass Splunk's authentication mechanisms for a specific critical function, potentially leading to unauthorized data access, system manipulation, or even privilege escalation. This aligns with T1078 Valid Accounts if an authenticated but unprivileged session is needed, or T1190 Exploit Public-Facing Application if the critical function is directly exposed to unauthenticated users. Core security controls like IA-2 Identification and Authentication (Organizational Users) and AC-3 Access Enforcement are clearly missing or misconfigured here.

The Microsoft Defender zero-day, "RoguePlanet" (CVE-2026-50656), is a local elevation of privilege vulnerability. It exploits a race condition within Defender, allowing an authenticated, local attacker to execute arbitrary code with SYSTEM-level privileges. A race condition is like two cars trying to merge into one lane at the exact same time; if one process (the malicious one) wins the race to access a resource before Defender can properly secure it, it can achieve its goal. In this case, Nightmare Eclipse found a way to win that race, spawning a command shell with the highest possible privileges on a Windows system. This is a classic T1068 Exploitation for Privilege Escalation scenario. The immediate remediation is SI-2 Flaw Remediation, deploying the patch as soon as Microsoft releases it. CM-6 Configuration Settings and continuous monitoring are crucial to detect attempts to exploit such flaws.

Historical Context

The ongoing saga of CISA KEV additions, particularly for widely used applications like Splunk and Joomla, echoes the rapid-fire exploitation we saw with Log4Shell (CVE-2021-44228) in late 2021. Log4Shell, a critical RCE vulnerability in the Apache Log4j library, was added to the KEV catalog almost immediately after its public disclosure due to widespread and aggressive in-the-wild exploitation.

Similar to the current situation, Log4Shell demonstrated how a single vulnerability in a pervasive software component could expose vast swathes of the internet. The speed at which attackers weaponized Log4Shell, often within hours of disclosure, mirrors the automated attacks already targeting the Joomla JCE vulnerability today. Both situations highlight that patching critical vulnerabilities must occur with extreme urgency, not just for federal agencies but for all organizations. The difference lies in the scope and complexity: Log4Shell was a pervasive library dependency, making detection and patching a monumental task across diverse systems. The current Splunk and Joomla vulnerabilities, while critical, are tied to specific applications, which should make the remediation path clearer, though no less urgent.

Data at a Glance

The CVEDaily Take

The KEV additions for Splunk and Joomla, coupled with the Defender zero-day and the Mackay Sugar breach, paint a picture of relentless, high-impact threats. We observe a pattern where critical patches are available well before CISA adds the vulnerability to the KEV, as seen with the Joomla JCE. This gap of 14 days between patch release and KEV listing creates a window of heightened vulnerability for organizations that wait for CISA's mandate. Prioritize patching the KEV entries immediately; these are no longer theoretical risks.
Has your team audited web server access logs for JCE profile import attempts since this patch dropped?

FAQ

Q1: What's the immediate priority for federal agencies regarding these KEVs?
A1: Federal Civilian Executive Branch (FCEB) agencies must remediate CVE-2026-20253 (Splunk Enterprise) by July 3, 2026, and CVE-2026-48907 (Joomla JCE) by June 19, 2026, as mandated by CISA's Binding Operational Directive (BOD) 26-04.

Q2: Can the Joomla JCE vulnerability be exploited even if site registration is closed?
A2: Yes, Joomla confirmed that CVE-2026-48907 can still be exploited even if public registration is disabled, as the vulnerability resides in the JCE editor's profile import task, which doesn't require user registration for exploitation.

Q3: What should we do about the Microsoft Defender zero-day while awaiting a patch?
A3: Since CVE-2026-50656 is a local elevation of privilege, focus on preventing initial access and restricting local administrative privileges. Monitor Microsoft MSRC advisories for an official patch, and ensure your endpoint detection and response (EDR) solutions are configured to detect anomalous process creation or privilege escalation attempts.