Key Takeaways<\/p>\n
- \n
- KEV since 10.07.2026.<\/strong> iCagenda and Balbooa Forms with confirmed active exploitation.<\/li>\n
- Patch level firm.<\/strong> iCagenda 4.0.8 \/ 3.9.15; Balbooa Forms 2.4.1 or newer.<\/li>\n
- IoCs in upload folders.<\/strong> PHP under images\/icagenda and images\/baforms is a red flag.<\/li>\n
- Inventory first.<\/strong> Which sites run which extension version? Without a list, the patch is random.<\/li>\n<\/ul>\n<\/div>\n
Related:<\/span>Four Vulnerabilities in KEV<\/a> \/<\/span> Squidex Upload Vulnerability<\/a><\/p>\n
What CISA Added to KEV on July 10<\/h2>\n
What is the Joomla Known Exploited Vulnerabilities (KEV) Upload?<\/strong> A third\u2011party extension with unauthenticated upload of dangerous file types. CVE-2026-48939 affects iCagenda (com_icagenda) via public event submission. CVE-2026-56291 affects Balbooa Forms (com_baforms): frontend upload without login, without CSRF check, and without extension whitelist through version 2.4.0.<\/p>\n
\nDefinition \u00b7 KEV Upload RCE<\/p>\n
A publicly reachable upload interface accepts executable files without authentication. The attacker uploads PHP and gains remote code execution on the web server.<\/p>\n<\/div>\n
Both vulnerabilities are, according to disclosure sources, zero\u2011days actively exploited. CISA lists them as Unrestricted Upload of File with Dangerous Type. For U.S. federal agencies, BOD 26-04 applies with priority remediation. For DACH operators, KEV is not a legal requirement but a strong priority signal.<\/p>\n
Patch Level and Affected Versions<\/h2>\n
iCagenda: according to mySites.guru affected versions 3.2.1 through 3.9.14 and 4.0.0 through 4.0.7. Fix in 4.0.8<\/strong> (June 15, 2026) and Legacy 3.9.15<\/strong> (June 16, 2026). The severity is in the critical range (Finder matrix often 9.8, in parts of the discussion up to 10.0).<\/p>\n
Balbooa Forms: affected up to and including 2.4.0. Fix in 2.4.1<\/strong> (July 9, 2026), Finder designation CVSS 4.0 score 10.0. The changelog initially listed the measures under \u201cFixed\u201d without a clear security banner. Those who only filter by the word \u201csecurity\u201d will miss the fix.<\/p>\n
Inventory, Indicators of Compromise (IoCs) and Checklist<\/h2>\n
CMS campaigns rarely hit the core first. They target the extension with a public upload. Agencies with many Joomla sites need an inventory list: site, extension, version, publicly reachable yes\/no. Parallel to patching: check the upload folder. Balbooa Forms typically places attachments under images\/baforms\/uploads\/. iCagenda uses paths under images\/icagenda. Any unexpected .php file there is a compromise indicator.<\/p>\n
\nJoomla Upload KEV now<\/p>\n
- \n
- ✓<\/span>Scan all sites on iCagenda and Balbooa Forms and export versions<\/li>\n
- ✓<\/span>Update to the minimum version immediately, not waiting for the maintenance window<\/li>\n
- ✓<\/span>Check the upload folder for PHP and unknown shells; sift through the super\u2011user list<\/li>\n
- ✓<\/span>Inspect logs for POSTs to baforms-\/icagenda upload tasks before the patch deadline<\/li>\n
- ✓<\/span>WAF: block anonymous uploads with executable extensions until the inventory is green<\/li>\n<\/ul>\n<\/div>\n
Earlier this week, CISA also added related Joomla builder vulnerabilities to the KEV context (according to a Finder roundup on Page Builder CK and SP Page Builder). The pattern is stable: anonymous form and AJAX endpoints without a strict allowlist. Form builders and event plugins are the attack surface, not just content tools. Primary sources: CISA Alert 10.07.2026, vendor changelogs, technical analyses by mySites.guru.<\/p>\n
Frequently Asked Questions<\/h2>\n
Every question is locked. A tap unlocks the answer.<\/p>\n
\nIs a core update from Joomla sufficient?<\/strong><\/summary>\n
No. The gaps are in third-party extensions. Core patches do not replace extension updates.<\/p>\n<\/details>\n
\nAre only US authorities affected?<\/strong><\/summary>\n
Known Exploited Vulnerabilities (KEV) primarily target the US Federal Civilian Executive Branch (FCEB). Active exploitation applies globally. Every publicly accessible Joomla site with the extensions is in scope.<\/p>\n<\/details>\n
\nWhat to do if an immediate update isn’t possible?<\/strong><\/summary>\n
Disable public forms with file upload or take the extension offline. Then conduct a forensic review, then apply patches.<\/p>\n<\/details>\n
\nWhich IoCs are practical?<\/strong><\/summary>\n
Unexpected PHP files were found in the images\/baforms and images\/icagenda directories, along with new super\u2011user accounts, an altered configuration.php, and unknown webshell paths.<\/p>\n<\/details>\n
\nWhere is the primary source?<\/strong><\/summary>\n
CISA Known Exploited Vulnerabilities Alert on 10.07.2026 for CVE-2026-48939 and CVE-2026-56291; Changelogs iCagenda 4.0.8\/3.9.15 and Balbooa 2.4.1; Analysis, among others, mySites.guru.<\/p>\n<\/details>\n
<\/p>\n
Lesetipps der Redaktion<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/sharepoint-jwt-bypass-cve-2026-55040-cover-hero-250x143.jpg\")
<\/span>Lesetipp<\/span>SharePoint-JWT-Bypass \u00f6ffnet On-Prem-Sites<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/bitlocker-bypass-cve-2026-50661-cover-hero-250x143.jpg\")
<\/span>Lesetipp<\/span>BitLocker-Bypass bei physischem Zugriff<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/vier-luecken-im-kev-eine-zieht-cloud-schluessel-ab-cover-hero-250x143.jpg\")
<\/span>Lesetipp<\/span>Vier L\u00fccken im KEV – eine zieht Cloud-Schl\u00fcssel ab<\/span><\/span><\/a><\/p>\nMehr aus dem MBF Media Netzwerk<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-aws-sovereign-cloud-was-wirklich-getrenn-12030184.jpg\")
<\/span>cloudmagazin<\/span>AWS Sovereign Cloud: was wirklich getrennt ist<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-digitaler-produktpass-hersteller-pflicht-48690623-250x141.jpg\")
<\/span>MyBusinessFuture<\/span>Digitaler Produktpass: Was Hersteller tun m\u00fcssen<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-token-opex-inference-steuert-nicht-das-s-43794747-250x141.jpg\")
<\/span>Digital Chiefs<\/span>Token-OPEX: Inference steuert, nicht das Seat-Budget<\/span><\/span><\/a><\/p>\nBildquelle: KI-generiert (Juli 2026)<\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"CISA adds CVE-2026-48939 (iCagenda) and CVE-2026-56291 (Balbooa Forms) to KEV. CVSS up to 10.0, active exploitation, patch levels, and IoC checks.","protected":false},"author":10,"featured_media":22152,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"Joomla vulnerabilities CISA KEV iCagenda Balbooa","_yoast_wpseo_title":"Two Joomla Upload Vulnerabilities Added to CISA KEV","_yoast_wpseo_metadesc":"CISA includes CVE-2026-48939 (iCagenda) and CVE-2026-56291 (Balbooa Forms) in KEV. Patch levels, IoCs, and inventory checklist.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"en","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[255],"tags":[],"class_list":["post-22166","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-praxis-umsetzung-en"],"evm_reading_time_minutes":4,"wpml_language":"en","wpml_translation_of":22137,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22166","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=22166"}],"version-history":[{"count":0,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22166\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/22152"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=22166"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=22166"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=22166"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- ✓<\/span>Update to the minimum version immediately, not waiting for the maintenance window<\/li>\n
- Patch level firm.<\/strong> iCagenda 4.0.8 \/ 3.9.15; Balbooa Forms 2.4.1 or newer.<\/li>\n