Critical RCE Vulnerabilities in Joomla Extensions CVE-2026-48907 & CVE-2026-48908

Two critical vulnerabilities affecting Joomla extensions have been reported: CVE-2026-48907 in the Joomla Content Editor (JCE) and CVE-2026-48908 in the SP Page Builder. Both vulnerabilities allow unauthenticated remote attackers to execute arbitrary PHP code on affected servers, leading to potential full server compromise. CVE-2026-48907 affects JCE versions 1.0.0 to 2.9.99.4, while CVE-2026-48908 impacts SP Page Builder versions 1.0.0 to 6.6.1. Successful exploitation can result in data theft, defacement, and persistent unauthorized access. The vulnerabilities have been assigned a critical risk level with a CVSS score of 10.0. Administrators are urged to update to the latest versions or apply available patches immediately. Both vulnerabilities have been added to the CISA KEV list due to active exploitation. Affected entities are advised to report incidents to NC4 for coordination and intelligence sharing.

Key Points: • CVE-2026-48907 and CVE-2026-48908 are critical RCE vulnerabilities in Joomla extensions. • Both vulnerabilities allow unauthenticated attackers to execute arbitrary PHP code remotely. • Immediate updates or patches are recommended to mitigate risks of data theft and server compromise.