CISA just added two critical Joomla extension vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, and the scary part is what attackers do with them. CVE-2026-48939 hits the iCagenda events calendar extension, and CVE-2026-56291 hits Balbooa Forms. Both carry a maximum CVSS score of 10 and, according to CISA, allow attackers to upload arbitrary files that can ultimately be executed as PHP code on the server. In other words: these are not “data exposure” bugs. They are remote code execution paths, which turns a typical content or forms workflow into a direct door for takeover.

The implications land immediately for anyone running public-facing Joomla sites, because CISA also ordered federal civilian agencies to patch under the agency's vulnerability management directive. That directive language matters because KEV is basically the government saying, “We have evidence of real exploitation, and timelines are now real timelines.” Joomla itself powers roughly 1.2 percent of all websites, around a million sites worldwide, and the risk is amplified by how Joomla is built and extended. Extensions developed by independent, third-party companies do much of the heavy lifting beyond the core platform, which means the security posture of a site depends heavily on the update discipline and vulnerability management of everyone in that extension ecosystem.

Let’s start with iCagenda. CISA says the bug lets attackers upload a malicious PHP file through iCagenda's attachment feature. What sounds like ordinary “file upload” becomes remote code execution when that uploaded file can be treated as executable PHP on the server. CISA also notes that the attackers specifically targeted the extension's “Submit an Event” feature, which allows visitors to contribute events to a site calendar. Researchers reported automated scanning aimed at finding vulnerable installations before dropping web shells onto compromised servers. The sequence is worth paying attention to for operators: the attackers are not just randomly exploiting. They are scanning for known vulnerable versions and then staging the payload quickly, which is exactly the kind of behavior that makes KEV listings stick and keep hurting organizations that treat patches as optional “later” work.

There is also a timeline detail that should make security teams itch. Security firm mySites.guru said it spotted attackers exploiting the iCagenda bug just hours before patched versions 4.0.8 and 3.9.15 were released in mid-June. That means there was no “quiet window” between discovery and weaponization. Attackers were already moving while defenders were still catching up with release coordination. Practically, this is a reminder that the time between a vulnerability becoming known and it being actively abused can be extremely short, especially for popular extensions that sit on public-facing sites.

Now for Balbooa Forms, where the pattern is eerily similar but the technical pathway is framed differently. Researchers said Balbooa Forms' frontend upload endpoint accepted files from anonymous visitors without authentication, CSRF protection, or meaningful checks on file types. That combination is a classic recipe for trouble: if you do not require a logged-in user, do not guard the request against forgery, and do not validate what file types are acceptable, then an attacker can push a payload into a publicly accessible directory. Researchers say that payload can then be executed remotely as PHP, turning a forms tool used for contact requests, registrations, surveys, and file uploads into an execution engine.

Researchers said they uncovered the Balbooa Forms flaw while investigating an abuse report from a customer whose Joomla site was already under attack. That is another second-order signal for leadership: incident intake is often where the “first warning” comes from, and that report may already be downstream of months of attacker curiosity. Balbooa responded by releasing version 2.4.1 on July 9, but researchers warned that exploitation is continuing against sites that have not updated. So even after patches land, the operational reality is that there are always lagging systems, legacy installs, and forgotten environments that do not get the memo fast enough.

If there is a silver lining, it is that fixes are already available. But the downside is the thing executives often underestimate until it becomes their own problem: attackers did not wait around for release notes. For boards and security leadership, the strategic stake is broader than two extension names. Joomla runs at scale, and extensions are the integration layer between “open source” and “internet-accessible.” KEV listing means the risk is now quantified as actively exploited, which should force a tightening of patch SLAs, extension inventory practices, and vulnerability monitoring across the whole stack, not just the core CMS. For any organization that hosts public forms, event submissions, or similar user-driven features on Joomla, this is a prompt to treat extension updates like production infrastructure updates, not discretionary maintenance.

In short: CISA is labeling these issues as actively exploited, the vulnerabilities are maximum severity with remote code execution outcomes, and the attack details show automation plus targeted feature abuse. The only way to stop this kind of campaign is to shrink the gap between “vulnerable” and “patched” before attackers close it for you.