iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days

CISA added two maximum-severity (CVSS 10.0) Joomla extension vulnerabilities—iCagenda (CVE-2026-48939) and Balbooa Forms (CVE-2026-56291)—to its Known Exploited Vulnerabilities list after reports of zero-day exploitation that allow unauthenticated arbitrary file upload and remote code execution; vendors released patches and IOCs advise checking upload folders and admin accounts while ACSC warns of a global CMS-targeting campaign deploying web shells.