Critical Joomla JCE Vulnerability Under Active Exploitation

A critical unauthenticated remote code execution vulnerability (CVE-2026-48907, CVSS 10.0) in the Joomla Content Editor (JCE < 2.9.99.6) is being actively exploited; CISA added it to the KEV catalog on 2026-06-16. Attackers import malicious editor profiles to upload PHP web shells, automated scanning campaigns have compromised hundreds of Joomla sites, and site owners are urged to update to JCE 2.9.99.6 and search for unauthorized profiles and suspicious PHP files.