Two maximum-severity Joomla zero-day vulnerabilities in the iCagenda and Balbooa Forms extensions are being actively exploited in the wild, prompting CISA to add both to its Known Exploited Vulnerabilities catalog. Both flaws carry a CVSS score of 10.0, the highest possible rating, and allow unauthenticated attackers to upload arbitrary PHP files and achieve full remote code execution on vulnerable Joomla sites. Site administrators must patch immediately.

Vulnerability Details

CVE-2026-48939 -- iCagenda (CVSS 10.0)

The iCagenda calendar extension for Joomla ships with a "Submit an Event" form that lets visitors propose events. According to mySites.guru, a cloud-based dashboard for managing WordPress and Joomla websites, this form has been exploited as a zero-day since at least June 15, 2026.

The flaw resides in the file attachment functionality of the event submission form. An attacker can upload a malicious PHP file disguised as an event attachment. Because the component writes uploaded files directly to a predictable path, images/icagenda/frontend/attachments/, the attacker can then access that PHP file through the web server and execute arbitrary code on the host.

"We first saw it in a client's access log: an automated scanner identifying itself as 'icagenda-batch/1.0' grabbed a token, posted a malicious upload to the submit endpoint, then fetched the planted shell at the exact path the component writes attachments to," mySites.guru said in its disclosure.

The extension developer JoomliC has released patches in iCagenda versions 4.0.8 and 3.9.15.

CVE-2026-56291 -- Balbooa Forms (CVSS 10.0)

The second zero-day targets Balbooa Forms, a popular Joomla form builder. All versions up to and including 2.4.0 are vulnerable. The frontend attachment upload endpoint accepts file uploads from any anonymous visitor with no authentication, no CSRF token, and no file type validation.

MySites.guru, which discovered the vulnerability on July 8, 2026 during a live attack on one of its customers, described it bluntly: "An attacker could upload a PHP file into a public folder and then run it, which is unauthenticated remote code execution, the worst outcome a web flaw can have."

The fix is available in Balbooa Forms version 2.4.1.

Impact Assessment

Both vulnerabilities are rated CVSS 10.0, critical severity. The attack surface is substantial. Joomla powers approximately 2 million websites worldwide, and both iCagenda and Balbooa Forms have significant installation bases across business directories, event management sites, and community portals.

An attacker who successfully exploits either vulnerability gains full control of the web server, including:

• Complete file system access (read, write, delete)
• Database credential extraction and data exfiltration
• Lateral movement to internal networks
• Web shell persistence for ongoing access
• Potential to pivot to other CMS installations on the same server

Affected Systems

Extension	Versions Affected	Patched Version
iCagenda	Prior to 4.0.8 and 3.9.15	4.0.8 / 3.9.15
Balbooa Forms	2.4.0 and earlier	2.4.1

Any Joomla site running these extensions is at risk. Both vulnerabilities are being actively scanned for and exploited in automated attacks.

Global Exploitation Campaign

The Australian Cyber Security Centre (ACSC) has issued a formal alert warning of a global exploitation campaign targeting multiple CMS vulnerabilities. The agency reported that malicious actors are actively scanning websites for opportunities to deploy web shells, leveraging flaws in CMS software and plugins.

"Once deployed, the web shells serve as conduits for remote access and control of the targeted web servers," the ACSC said in its advisory. "This highly scaled global exploitation campaign demonstrates the rapidly evolving cyber risk facing organizations."

The ACSC specifically noted that advances in AI are accelerating the speed and scale of cyber operations, "reducing the time between vulnerability disclosure and exploitation."

Mitigation and Patching

Site administrators should take the following steps immediately:

1. Update iCagenda to version 4.0.8 or 3.9.15 (whichever applies to your Joomla version)
2. Update Balbooa Forms to version 2.4.1
3. Check for compromise: Scan the images/icagenda/frontend/attachments/ directory for suspicious PHP files and remove any that are not legitimate attachments
4. Review server logs: Look for automated scanners identifying themselves as "icagenda-batch/1.0" or unusual POST requests to form submission endpoints
5. Review uploaded files: In Balbooa Forms, audit all recently uploaded files for PHP content

Detection

Indicators of compromise provided by mySites.guru include:

• Automated scanners with User-Agent icagenda-batch/1.0 in access logs
• Suspicious PHP files in images/icagenda/frontend/attachments/
• Unexpected form submissions followed by file access requests
• Web shell activity on the server (unusual outbound connections, file modifications)

Frequently Asked Questions

Do these vulnerabilities require authentication? No. Both are unauthenticated -- no login is required to exploit them.

Are these the same as the Joomla extensions CISA warned about last week? No. The previously reported vulnerabilities affected Page Builder CK, SP Page Builder, and JCE Editor. These new zero-days affect iCagenda and Balbooa Forms, entirely different extensions.

What is the deadline for federal agencies to patch? CISA has ordered Federal Civilian Executive Branch agencies to patch by July 13, 2026.

Can a web application firewall (WAF) block these attacks? A WAF may detect and block some exploit attempts, but patching is the only complete mitigation. WAF rules can screen for PHP file uploads to form endpoints, but attackers can vary payloads to evade detection.

Should I remove the extensions if I don't use them? Yes. Any unused extension with known vulnerabilities increases your attack surface. Disable and uninstall iCagenda or Balbooa Forms if they are not actively used on your site.

Key Takeaways

• Two CVSS 10.0 Joomla zero-days are under active exploitation -- patch immediately
• CVE-2026-48939 affects iCagenda (patched in 4.0.8/3.9.15)
• CVE-2026-56291 affects Balbooa Forms (patched in 2.4.1)
• CISA has added both to the KEV catalog with a July 13 deadline
• ACSC warns of a global CMS exploitation campaign accelerated by AI
• Check for compromise indicators even after patching

---

Sources: The Hacker News, NVD CVE-2026-48939, NVD CVE-2026-56291, CISA KEV Catalog, ACSC Advisory