Patch Joomla JCE now: max-severity flaw (CVE-2026-48907) under automated attack

If you run a Joomla (CMS) site with the JCE editor, treat this as a patch-now item. CVE-2026-48907 is a maximum-severity improper-access-control flaw in Widget Factory’s Joomla Content Editor (JCE) plugin that, according to CISA and BleepingComputer’s writeup, lets an unauthenticated attacker create new editor profiles and through them upload and execute PHP code on the server. That’s a webshell on your box, no login required.

It’s being exploited in the wild right now. CISA’s wording is blunt: “working exploit code is public, and the attacks are automated, so a site with no public registration is not safe.” It’s on the KEV list, and federal agencies have a Friday deadline to patch under Binding Operational Directive 26-04 — which is usually a decent signal for the rest of us to move too.

The fix is JCE Pro 2.9.99.6, released early June; anything older than this version is vulnerable.

Patching only closes the door. If your site was already hit, the update doesn’t evict whoever got in. Rotate credentials and scan for dropped files and unexpected admin/editor profiles. Some tips on how to use this is using the find command for instance, searching for recently edited files.

For instance if you are seeing this on the 17th of June and want to track for “touched files” just run from your terminal, within your http directory:

find -name "*.php" -mtime -17 -> If you see unfamiliar files that have been touched this month, you might as well dig a bit deeper and look at your network logs. A full sweep from the team that actually manages your platforms content could also help identifying files that shouldn’t be there at all.

Sources

• CISA orders feds to patch max severity Joomla plugin flaw by Friday — BleepingComputer
• CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution — The Hacker News