Is CVE-2026-48907 actively exploited?

Yes. CVE-2026-48907 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2026-48907 be exploited remotely?

Yes. CVE-2026-48907 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-48907?

CVE-2026-48907 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2026-48907

CRITICALCISA KEVIN THE WILD

CVE-2026-48907

CWE-284Published: June 5, 2026· Updated: Jun 17, 2026

9.8

CVSS v3.1

EPSS:0.11%probability of exploitation in 30 daysPercentile:29.0th

Official Description

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.

NVD Source

Risk Analysis

This critical vulnerability in the JCE editor extension for Joomla allows unauthenticated users to create new editor profiles. With a perfect CVSS score of 10.0, this flaw can lead to PHP code upload and execution, resulting in complete system compromise. It is confirmed to be actively exploited, requiring immediate attention.

This vulnerability is actively being exploited in the wild. It is remotely exploitable over the network with low attack complexity and requires no authentication.

Recommended Action

Update the JCE editor extension for Joomla to a patched version. Implement strict access controls and regularly review user permissions on Joomla installations.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-48907 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.

CISA has added CVE-2026-48907 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

widgetfactorylimited1 product(s)

jce

Source: NVD CPE · 1 total CPE entries

Exploit & PoC Resources

ACTIVE EXPLOITATIONConfirmed exploitation in the wild

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

ADVISORYhttps://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites

News & Research Mentioning CVE-2026-48907

CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution

The Hacker News· Jun 17, 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting Widget Factory Joomla Content Editor (JCE) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-48907 (CVSS score: 10.0), is a case of improper access control that could facilitate arbitrary [xlite_meta score:56 src:The Hacker News xlite_fp:567fc325777df7deadccfecc5c932cb10f3174b6d80adf2ab84bf3cb0bd5719c]

CISA Adds One Known Exploited Vulnerability to Catalog

CISA Alerts· Jun 16, 2026

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-48907 Widget Factory Joomla Content Editor Improper Access Control Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies, updating BOD 22-01. BOD 26-04 reinforces the importance of the KEV catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common V [xlite_meta score:48 src:CISA Alerts xlite_fp:3d84dbba07cc2ff81925c49cc7928ee073d5411e6df370e944886052fa090664]