CISA Warns of Actively Exploited Joomla Zero-Day Vulnerabilities

CISA added two critical Joomla extension vulnerabilities (CVE-2026-48939 in iCagenda and CVE-2026-56291 in Balbooa) to its Known Exploited Vulnerabilities catalog after confirmed active zero‑day attacks that allow unauthenticated file uploads and remote code execution; administrators are urged to apply patches and inspect upload directories for web shells. The report also highlights a broader global CMS plugin exploitation campaign targeting multiple platforms and provides detection and mitigation recommendations.