CVE-2026-48907: listed in the CISA KEV catalog CVE-2026-48907 · EPSS 85% · KEV 2026-06-16
A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.
Is CVE-2026-48907 exploited? Listed in the CISA KEV catalog on 2026-06-16. Federal remediation due 2026-06-19. Past that date by 133 days. EPSS puts exploitation in the next 30 days at 85%. Public exploit code: packaged in a public tool. Public detection rules exist. Which products and versions are affected? joomlacontenteditor.net · Joomla Content Editor (JCE) extension for Joomla · 1.0.0-2.9.99.4 Is there a patch? joomlacontenteditor.net's record doesn't name a fixed version.
joomlacontenteditor.net advisory
What PlainSec published about CVE-2026-48907 Primary sources What this record does not say No CVSS score from NVD. No patch identifier. KEV and EPSS are re-checked daily. Record last updated 2026-10-25.
CVE-2026-48907: listed in the CISA KEV catalog CVE-2026-48907 · EPSS 85% · KEV 2026-06-16
A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.
Is CVE-2026-48907 exploited? Listed in the CISA KEV catalog on 2026-06-16. Federal remediation due 2026-06-19. Past that date by 133 days. EPSS puts exploitation in the next 30 days at 85%. Public exploit code: packaged in a public tool. Public detection rules exist. Which products and versions are affected? joomlacontenteditor.net · Joomla Content Editor (JCE) extension for Joomla · 1.0.0-2.9.99.4 Is there a patch? joomlacontenteditor.net's record doesn't name a fixed version.
joomlacontenteditor.net advisory
What PlainSec published about CVE-2026-48907 Primary sources What this record does not say No CVSS score from NVD. No patch identifier. KEV and EPSS are re-checked daily. Record last updated 2026-10-25.