Critical RCE Vulnerabilities in Joomla Extensions CVE-2026-48907 & CVE-2026-48908

Nacsa.My

Critical RCE Vulnerabilities in Joomla Extensions CVE-2026-48907 & CVE-2026-48908

First seen 4 Aug 2026, 14:23 UTC • •89.0

Article Content

1 / 5

Browse articles

ThreatCluster •August 5, 2026 at 14:09 UTC

•CVE-2026-48907 and CVE-2026-48908 are critical RCE vulnerabilities in Joomla extensions.
•Both vulnerabilities allow unauthenticated attackers to execute arbitrary PHP code remotely.
•Immediate updates or patches are recommended to mitigate risks of data theft and server compromise.

Two critical vulnerabilities affecting Joomla extensions have been reported: CVE-2026-48907 in the Joomla Content Editor (JCE) and CVE-2026-48908 in the SP Page Builder. Both vulnerabilities allow unauthenticated remote attackers to execute arbitrary PHP code on affected servers, leading to potential full server compromise. CVE-2026-48907 affects JCE versions 1.0.0 to 2.9.99.4, while CVE-2026-48908 impacts SP Page Builder versions 1.0.0 to 6.6.1. Successful exploitation can result in data theft, defacement, and persistent unauthorized access. The vulnerabilities have been assigned a critical risk level with a CVSS score of 10.0. Administrators are urged to update to the latest versions or apply available patches immediately. Both vulnerabilities have been added to the CISA KEV list due to active exploitation. Affected entities are advised to report incidents to NC4 for coordination and intelligence sharing.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 75d ago How this analysis works

Timeline

2026-06-05

CVE-2026-48907 published

A critical improper access control vulnerability in JCE was disclosed, allowing RCE.

2026-06-10

First public PoC for CVE-2026-48907

A proof of concept for exploiting the JCE vulnerability was made public, increasing risk.

2026-06-16

CVE-2026-48907 added to CISA KEV

CISA added CVE-2026-48907 to its Known Exploited Vulnerabilities catalog due to active exploitation.

2026-06-20

CVE-2026-48908 published

A critical improper access control vulnerability in SP Page Builder was disclosed, allowing RCE.

2026-06-22

First public PoC for CVE-2026-48908

A proof of concept for exploiting the SP Page Builder vulnerability was released.

2026-07-07

CVE-2026-48908 added to CISA KEV

CISA included CVE-2026-48908 in its Known Exploited Vulnerabilities list due to ongoing exploitation.

2026-08-04

Advisory issued for CVE-2026-48907 and CVE-2026-48908

NACSA issued advisories urging immediate updates to affected Joomla extensions to mitigate risks.

More articles in this cluster (4)

Threat Graph

8 entities, 15 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Malware
Zero-day Exploit
T1505.003 - Web Shell

Vulnerability (2)

CVE-2026-48907
CVE-2026-48908

Affected Platform (3)

Joomla
PHP
SP Page Builder

Relationships

CVE-2026-48907 targets Joomla
CVE-2026-48907 targets PHP
CVE-2026-48907 targets SP Page Builder
CVE-2026-48908 targets Joomla
CVE-2026-48908 targets PHP
CVE-2026-48908 targets SP Page Builder
Malware targets Joomla
Malware targets PHP
Malware targets SP Page Builder
Zero-day Exploit targets Joomla
Zero-day Exploit targets PHP
Zero-day Exploit targets SP Page Builder
T1505.003 - Web Shell targets Joomla
T1505.003 - Web Shell targets PHP
T1505.003 - Web Shell targets SP Page Builder

Following this threat?

Track CVE-2026-48907 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

Silent Lynx Targets CIS Governments via WinRAR Exploit The threat actor Silent Lynx has launched a series of attacks against government organizations in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks exploit a vulnerability in WinRAR (CVE-2025-8088) to deploy reverse shells, including FoalShell and PickleShell, facilitating…