CISA KEV: Critical Joomla JCE RCE Actively Exploited

Attackers are actively exploiting CVE-2026-48907, a critical improper access control vulnerability in Joomla Content Editor (JCE) versions 1.0.0 through 2.9.99.4, leading to unauthenticated remote code execution (RCE). CISA added this RCE to its KEV catalog on June 17, 2026, mandating federal agencies to patch by June 19, 2026. This urgency comes during a week of serious compromises, including ransomware attacks by the Aurora group, and data breaches impacting Novo Nordisk, the Texas government, and the Council of Europe, highlighting widespread credential theft and supply chain risks.

What Happened

The Joomla Content Editor (JCE) flaw, CVE-2026-48907, has a CVSS 10.0 score, allowing unauthenticated attackers to achieve RCE. It stems from improper access control in the profiles.import function (index.php?option=com_jce&task=profiles.import). Attackers send specially crafted HTTP POST requests containing malicious PHP scripts. The component accepts these without validating file type or enforcing access controls, even from unauthenticated users.

Once uploaded, the malicious PHP is executed by browsing to its public location. This leads to webshell deployment, full RCE capabilities, and the establishment of persistent backdoors within the compromised Joomla environment. CISA identified active exploitation in the wild via automated attacks and added CVE-2026-48907 to its Known Exploited Vulnerabilities (KEV) catalog on June 17, 2026.

This critical Joomla issue emerges amidst a busy week for security teams. The Aurora ransomware group claimed attacks on ALS Global, Diamond Truck Centres, and Sumitomo Electric Bordnetze, as reported by BleepingComputer. Novo Nordisk disclosed a data breach originating from an exposed GitHub token, and the Texas Parks & Wildlife Department reported compromise of over 3 million residents' PII. ShinyHunters also claimed a massive breach of Council of Europe HR data, which they allege was facilitated by an Oracle PeopleSoft zero-day; the Council of Europe has not confirmed this attack vector.

Why It Matters

This JCE RCE is critical because it offers an unauthenticated, direct path to arbitrary PHP code execution on vulnerable Joomla instances. Attackers can swiftly establish persistent backdoors, pivot into internal infrastructure, and exfiltrate sensitive data, including database credentials. The ease of exploitation via automated attacks means any exposed, unpatched JCE instance is a prime target for initial access.

The consequences are clear from recent incidents. Aurora ransomware’s attack on Diamond Truck Centres exposed 289 GB of bank deposit scans and 17 years of employee payroll data, including sensitive biometric and immigration documents, the group claims, as reported by SecurityWeek. Novo Nordisk's breach, claimed by FulcrumSec and TheUSERS007, allegedly compromised 1.3TB of source code, drug information, and AI models; Novo Nordisk has confirmed a breach of clinical trial data and HCP contact information, but has not confirmed the scope of data theft claimed by the threat actors. This risks immense R&D equity and potential regulatory penalties.

Beyond direct data theft, the Texas Parks & Wildlife breach of over 3 million residents' driver's license data fuels identity theft and sophisticated phishing campaigns. Similarly, the Council of Europe breach, reportedly via a zero-day exploited by ShinyHunters, exposed over 429,000 HR documents, the group claims. The Council of Europe confirmed a breach affecting over 10,000 staff members and approximately 300GB of HR and payroll data, but has not confirmed ShinyHunters' specific claims about the attack vector or the exact number of documents exposed. This sets the stage for fraud, blackmail, and targeted social engineering. These illustrate the devastating potential when initial access mechanisms, like the JCE RCE, are successfully used.

Affected Scope & Remediation

All Joomla Content Editor (JCE) installations running versions 1.0.0 through 2.9.99.4 are vulnerable to CVE-2026-48907. Patch immediately. JCE version 2.9.99.5, released on June 3, 2026, addresses the core vulnerability, with version 2.9.99.6 providing additional hardening. If you manage any Joomla sites, verify their JCE version immediately.

CISA's inclusion of CVE-2026-48907 in its KEV catalog on June 17, 2026, gives federal agencies until June 19, 2026, to remediate. That's a 14-day window from patch release to KEV listing, then just two days for federal agencies to patch. The rapid KEV listing signals critical, active exploitation that demands immediate attention from all organizations.

Beyond patching, audit your JCE profiles for any suspicious or unauthorized entries. Inspect all upload directories for unexpected PHP files or webshells, which can indicate an existing compromise. Review web server logs for unauthenticated POST requests targeting index.php?option=com_jce&task=profiles.import.

If compromise is suspected, rotate all credentials associated with the Joomla instance and underlying database. Tools like CrowdStrike Falcon can help detect and quarantine webshells or anomalous process execution post-exploitation. Implement strong security monitoring with solutions like KnowBe4 for user activity to catch any signs of lateral movement.

Patch Links:

• NVD Entry for CVE-2026-48907
• CISA KEV Catalog
• Joomla Project Site

Technical Breakdown

The crux of CVE-2026-48907 lies in a critical design flaw: the profiles.import function within JCE, intended for legitimate profile management, fails to enforce proper access controls and input validation. Think of it like a public-facing API endpoint that's supposed to handle only specific, authenticated data types but instead accepts anything you throw at it, no questions asked. The system does not differentiate between a benign profile update and a malicious PHP script disguised as one.

Attackers exploit this by sending a specially crafted HTTP POST request to index.php?option=com_jce&task=profiles.import. This request contains a malicious PHP file payload. Because the server-side code does not properly validate the file type or check user authentication, it blindly accepts the malicious PHP file and writes it to a publicly accessible directory on the web server. This fulfills the T1190 Exploit Public-Facing Application TTP.

Once the malicious PHP is on disk, the attacker simply needs to browse to its URL. This execution provides a webshell, granting them immediate remote code execution capabilities. From there, they can execute arbitrary commands, fulfilling the T1105 Ingress Tool Transfer for the webshell and subsequent actions like T1547 Boot or Logon Autostart Execution to establish persistent backdoors via cron jobs or other mechanisms. This can include modifying front-end editor components, leading to an altered toolbar as an Indicator of Compromise (IoC).

This vulnerability demonstrates a clear failure in NIST SP 800-53 AC-3 Access Enforcement by allowing unauthenticated users to perform privileged operations, and NIST SP 800-53 SI-10 Information Input Validation by not properly sanitizing or validating uploaded content. The impact can include database credential theft, full server compromise, and lateral movement into the network, leveraging the Joomla host as a pivot point.

Historical Context

The JCE RCE isn't an isolated incident; similar file upload vulnerabilities in Joomla and its components have a notable history. Back in 2012, several critical vulnerabilities in the JCE component allowed attackers to upload arbitrary files and gain remote code execution, as widely reported by security outlets. These older flaws often revolved around insufficient input sanitization and a lack of proper access control for file upload functionalities, much like CVE-2026-48907.

The difference now is the scale and automation of exploitation. While the underlying flaw type (improper file upload validation) is familiar, current threat actors use these vulnerabilities with highly automated scanners and botnets. This reduces the time between a patch release and widespread active exploitation to mere days or hours, emphasizing the critical need for rapid patching and continuous monitoring, far beyond the pace of a decade ago.

Data at a Glance

The CVEDaily Take

The confluence of the JCE RCE, multiple high-stakes ransomware attacks, and credential-based breaches paints a clear picture: initial access vectors are being relentlessly hammered, and lateral movement is a given once a foothold is established. Patching critical, actively exploited vulnerabilities like CVE-2026-48907 must be immediate, but it is only one piece of a defense-in-depth strategy that needs to assume compromise. We think the two-day mandate for federal agencies to patch, after a two-week period where the vulnerability was publicly known, highlights a reactive rather than proactive posture for an issue that stems from a decade-old class of bugs. Your team should be continually auditing public-facing applications for these recurring flaw patterns, not just waiting for the next CVE.

Has your team conducted a Red Team exercise focused on web application RCE to lateral movement in the last six months?

FAQ

Q: What exactly is the profiles.import function in JCE used for?
A: The profiles.import function allows JCE administrators to import predefined editor profiles, which customize the editor's toolbar, plugins, and settings. It's a legitimate administrative function intended to streamline configuration across multiple sites or users.

Q: How can we detect if our JCE instance has been compromised by CVE-2026-48907?
A: Key Indicators of Compromise (IoCs) include unexpected PHP files in your Joomla upload directories, suspicious or newly created JCE editor profiles, unauthenticated POST requests to index.php?option=com_jce&task=profiles.import in your web server logs, or an altered front-end JCE editor with missing toolbar elements.

Q: What is the recommended upgrade path for JCE to address this RCE?
A: You should immediately upgrade your Joomla Content Editor (JCE) installation to version 2.9.99.5 or, ideally, 2.9.99.6 for additional hardening. You can download the latest version from the official JCE website and follow their standard upgrade procedures for your Joomla environment.