Warning: Critical Vulnerability in Joomla Content Editor Extension (JCE), Patch Immediately!

Ccb.Belgium.Be • June 17, 2026

CVE-2026-48907 is a critical improper access control flaw in the Joomla Content Editor (JCE) extension, a widely used Joomla editor plugin. Attackers can use this vulnerability to gain unauthorized access to sensitive information.

JCE is an attractive target for attackers because it is a part of internet-facing CMS systems which can be easily reached by attackers. The vulnerability is especially dangerous since it requires no user privileges and user interaction to exploit, which leads to a high impact on the confidentiality, integrity and availability of the affected system.

Unauthenticated attackers can create new editor profiles which can result in PHP code upload and execution. Joomla has warned in their advisory that public exploit code and automated mass-scanning attacks have already been observed in the wild. Attackers can gain full access to the affected system by exploiting this vulnerability.

Patch The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing.

Monitor/Detect The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity, ensuring a swift response in case of an intrusion.

In case of an intrusion, you can report an incident via .

While patching appliances or software to the newest version may provide safety from future exploitation, it does not remediate historic compromise.

NIST NVD -

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Joomla JCE Vulnerability Under Active Exploitation A critical vulnerability in the Joomla Content Editor (JCE), tracked as CVE-2026-48907, allows unauthenticated attackers to execute remote code on affected Joomla sites. This flaw affects JCE versions below 2.9.99.6 and has a CVSS score of 10.0. Attackers exploit this vulnerability by importing rogue editor profiles to upload PHP web shells without any authentication. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog on June 16, 2026, indicating active exploitation in the wild. Automated scanning campaigns have targeted numerous Joomla sites, with hundreds already compromised. Site owners are urged to update to the latest version immediately and check for signs of exploitation, including unauthorized profiles and suspicious PHP files in writable directories. The vulnerability has been confirmed by multiple sources, including security advisories and independent analyses. 33 sources 87

Extracted Entities

Warning: Critical Vulnerability in Joomla Content Editor Extension (JCE), Patch Immediately!

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (2)

Platforms (1)