iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days

The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added two maximum-severity security flaws impacting iCagenda and Balbooa extensions for Joomla to its Known Exploited Vulnerabilities ( KEV ) catalog, following reports of zero-day exploitation in the wild. The vulnerabilities, both rated 10.

0 on the CVSS scoring system, are below - According to mySites. guru, a cloud-based dashboard service for managing WordPress and Joomla websites, CVE-2026-48939 is said to have been exploited as a zero-day since June 15, 2026, in automated attacks aimed at Joomla sites on which iCagenda is installed.

It resides in the "Submit an Event" form functionality, which lets users propose events for the calendar. "We first saw it in a client's access log: an automated scanner identifying itself as 'icagenda-batch/1.

0' grabbed a token, posted a malicious upload to the submit endpoint, then fetched the planted shell at the exact path the component writes attachments to," mySites. guru said . The flaw impacts the following versions - JoomliC has since released updates to address the issue in iCagenda versions 4. 0. 8 and 3. 9. 15.

Site owners are advised to check for suspicious PHP files in the "images/icagenda/frontend/attachments/" folder and remove them. MySites. guru said it also observed zero-day exploitation of CVE-2026-56291, which affects Balbooa Forms versions up to and including 2. 4. 0. It has been patched in version 2. 4. 1.

"Up to and including version 2. 4. 0, its frontend attachment upload had a serious flaw: it accepted a file from any anonymous visitor, with no login, no CSRF token, and no check on the file type," it said .

"An attacker could upload a PHP file into a public folder and then run it, which is unauthenticated remote code execution, the worst outcome a web flaw can have." The vulnerability was discovered by mySites. guru on July 8, 2026, following a live attack on one of its customers.

It has shared the following indicators of compromise - In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies have until July 13, 2026, to implement the fixes in their networks.

The disclosure comes as the Australian Cyber Security Centre (ACSC) issued an alert warning of a global exploitation campaign targeting various vulnerabilities in content management systems (CMS) and plugins.

"As part of this campaign, malicious cyber actors are actively scanning websites for opportunities to deploy web shells, leveraging various vulnerabilities affecting CMS software and plugins," the agency said .

"These vulnerabilities primarily allow unauthenticated file upload, remote code execution, server side request forgery or deserialization." Once deployed, the web shells serve as conduits for remote access and control of the targeted web servers.

Some of the identified security vulnerabilities are listed below - "This highly scaled global exploitation campaign demonstrates the rapidly evolving cyber risk facing organisations," ACSC said, adding "advances in AI are accelerating the speed and scale of cyber operations, reducing the time between vulnerability disclosure and exploitation."

Learn how to secure AI agents with practical controls for access, visibility, secrets, and risk containment. Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.