The advisory
The Cybersecurity and Infrastructure Security Agency added one new entry to its Known Exploited Vulnerabilities (KEV) catalog on June 16: CVE-2026-48907, an improper access control vulnerability in JCE (Joomla Content Editor), the plugin built and maintained by Widget Factory Limited. CISA's bulletin gives the flaw a maximum CVSS score of 10.0 and confirms it is being actively exploited. Federal civilian agencies were ordered to remediate under Binding Operational Directive 22-01 by June 19, a three-day window that reflects how CISA is treating the severity.
JCE is one of the most widely installed content editor extensions in the Joomla ecosystem, used on sites that range from small business brochureware to larger commercial deployments. That reach is part of why the flaw drew a fast KEV addition rather than sitting in the standard vulnerability disclosure queue.
What the flaw allows
According to Widget Factory's own security advisory and CISA's writeup, the vulnerability lets an unauthenticated attacker create a new editor profile inside JCE and use it to upload arbitrary PHP files to the server. Because JCE runs with the same privileges as the rest of the Joomla installation, a successfully uploaded file can execute as the web server user, giving the attacker a working web shell and a path to full site compromise. No login, no social engineering, and no prior access are required. The bug sits in how JCE validates requests to its profile-creation endpoint, not in Joomla core itself, so sites running Joomla without JCE installed are not affected.
The vulnerability affects all JCE versions from 1.0.0 through 2.9.99.4. Widget Factory shipped a fix in version 2.9.99.5 and followed with additional hardening in 2.9.99.6, which the vendor recommends as the target version for anyone patching now. A backport is available for sites running older, unsupported branches of JCE that cannot immediately move to the current release line.
Exploitation in the wild
CISA's KEV entries are added only when the agency has evidence of active exploitation, not theoretical risk. Coverage from The Hacker News and SecurityAffairs, both citing the same CISA and Widget Factory advisories, reports that automated scanning campaigns had already begun probing internet-facing Joomla installations for the vulnerable JCE endpoint before the KEV listing went live, consistent with the pattern CISA typically sees once a maximum-severity, no-auth vulnerability becomes public. BleepingComputer's reporting on the federal remediation order notes that the compressed patch deadline reflects both the ease of exploitation and the fact that a working proof of concept was circulating publicly at the time of disclosure.
No party has published attribution for who is running the scanning or exploitation activity, and this brief does not speculate on that point. The available advisories describe technique and impact, not actor.
Who needs to act
Anyone running a self-hosted Joomla site with JCE installed should check their editor version now. The check is straightforward: log into the Joomla administrator panel, navigate to the JCE component, and confirm the version number against 2.9.99.5 or later. Sites on managed Joomla hosting should confirm with their host whether JCE has already been patched at the platform level, since some hosts apply extension updates on behalf of customers and some do not.
For organizations required to track federal KEV deadlines, the June 19 remediation date applies to federal civilian executive branch agencies under BOD 22-01, but CISA's standing guidance is that all organizations, public or private, should treat KEV entries as a prioritization signal regardless of whether the binding directive technically applies to them. A CVSS 10.0, unauthenticated remote code execution flaw in an internet-facing content management extension is not one to leave in a patch backlog.
There is no indicated workaround short of upgrading. Disabling the JCE component entirely would remove the vulnerable functionality but breaks editing for any site that depends on it, so most site operators will want to prioritize the version upgrade over a temporary disable.
What to watch
Widget Factory has not published a count of how many active installations remain unpatched, and neither CISA nor the corroborating outlets have offered a specific compromise count tied to this campaign. If a breach notification or confirmed compromise tally tied to this specific CVE surfaces in the coming weeks, it would warrant separate coverage rather than an update folded into this brief.
Sources: CISA: Adds One Known Exploited Vulnerability to Catalog, June 16, 2026 · The Hacker News: CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution · SecurityAffairs: U.S. CISA adds Widget Factory Joomla Content Editor (JCE) flaw to its KEV catalog · BleepingComputer: CISA orders feds to patch max severity Joomla plugin flaw by Friday