CISA added two critical Joomla! extension vulnerabilities (iCagenda and Balbooa Forms) with CVSS 10 to its KEV catalog on July 10, 2026, due to
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) catalog on July 10, 2026, adding two vulnerabilities in Joomla! open-source content management system extensions. According to CISA's official announcement, these two vulnerabilities were included in KEV due to their CVSS severity score of 10 and evidence of active exploitation, requiring federal agencies to patch within 3 days[7][8]. iCagenda is event management software used to add and manage calendar events on Joomla! websites; Balbooa Forms is a form-building extension supporting drag-and-drop design[8]. Although both vendors have released patched versions, attackers launched large-scale automated attacks before the patches were available, resulting in extremely high risk of website infiltration[8].
The core cause of both vulnerabilities is classified as CWE-434: Unrestricted Upload of File with Dangerous Type[8]. Attackers can upload and execute arbitrary files via the "file attachment" feature provided by the extensions, leading to Remote Code Execution (RCE) attacks[8]. One vulnerability allows uploading and executing PHP code, while the other permits uploading executable files; both can result in RCE attacks[8].
According to security research investigations, one vulnerability was detected on June 15 with targeted automated attacks; code review confirmed the vulnerability, and it was reproduced in a Joomla 6 environment[8]. The vendor released a patched version on the same day, followed by a patch for the 3.x branch the next day, with the vulnerability officially disclosed on June 20[8]. The other vulnerability originated when a client received notification from their hosting provider about suspicious misuse activity on their Joomla website; a security research organization later confirmed the vulnerability and reproduced the exploitation process on July 8, reported it to the vendor, received a response, and the vendor released a patched version and disclosed the vulnerability ID the following day[8].
Affected products include all iCagenda and Balbooa Forms extensions not updated to the patched versions[8]. Although Joomla 5 and earlier core versions block PHP shell uploads because the website system's core prevents such uploads, verification is still required—for example, confirming that the images/icagenda/frontend/attachments/ directory in the user's website system contains only attachment files for calendar events[8]. Attackers have launched automated attacks targeting installed websites, specifically focusing on platforms managing WordPress and Joomla websites[8]. The other vulnerability also resulted in suspicious misuse activity on client websites, indicating that attacks have already successfully infiltrated[8]. If not patched promptly, attackers can fully control servers by uploading malicious files, steal data, or implant backdoors[8].
Organizations and federal agencies should immediately implement the following protective measures: First, ensure iCagenda is updated to the patched version and Balbooa Forms is updated to its patched version[8]. Second, even after updating, assume the website may have been attacked; check whether the images/icagenda/frontend/attachments/ directory contains only legitimate attachments and remove suspicious files[8]. Third, review the list of administrator accounts for suspicious entries and check for unknown files to confirm no backdoors exist[8]. Fourth, if immediate updating is not possible, temporarily disable the file attachment feature, move the upload directory outside the root directory, and configure the server to prevent execution of uploaded files[8]. Finally, private organizations are advised to reference the CISA KEV catalog to proactively review and patch vulnerabilities in their own infrastructure[7].