Waspada DigitalVerified developments. Evidence. Practical next steps.

Cyber Alerts

MA-1468.072026: MyCERT Alert - Critical Unauthenticated Remote Code Execution in Joomla Content Editor (JCE) Actively Exploited Against Malaysian Websites

Verified Officially confirmed Active exploitation confirmed

Recently, the Joomla Content Editor (JCE) maintainers has released a security update in the JCE extension tracked as CVE-2026-48907, an unauthenticated remote code execution vulnerability.

First observed
29 Jul 2026
Last checked
01 Aug 2026
Evidence records
7
Publication state
Published

What happened?

Current assessment

Recently, the Joomla Content Editor (JCE) maintainers has released a security update in the JCE extension tracked as CVE-2026-48907, an unauthenticated remote code execution vulnerability.

Why it matters

CISA includes this vulnerability in its Known Exploited Vulnerabilities catalog.

Who is affected?

Affected products and groups

  • Organisation: JoomShaper — Vendor or project named in the CISA KEV catalog.
  • Product: Joomla Content Editor (JCE) extension for Joomla versions 1.0.0 to 2.9.99.4. — Product or product group named in the MyCERT advisory.
  • Product: SP Page Builder — Product listed by CISA for JoomShaper.
  • Software: JCE Editor (Joomla Content Editor) Affected versions: 1.0.0 through 2.9.99.4 Fixed versions: 2.9.99.5 and later Recommended version: 2.9.99.9 or later Risk level: Critical (CVSS 10.0)
  • Software: SP Page Builder extension for Joomla from joomshaper.net Affected versions: 1.0.0 to 6.6.1 Recommended version: 6.6.2 or later Risk level: Critical (CVSS 10.0)

What should you do now?

Actions from official guidance

For technical teams

  1. Update SP Page builder to version 6.6.2 without delay on all Joomla installations. Official source
  2. Update JCE to version 2.9.99.6 (or at minimum 2.9.99.5) without delay on all Joomla installations. Official source
  3. 7.1 Update Immediately Official source
  4. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Official source
  5. For older deployments that cannot meet the requirements of 6.6.2, or upgrading is not immediately possible, restrict access to the upload functionality so that only authenticated administrators can use it. Official source
  6. For older deployments that cannot meet the requirements of 2.9.99.6 (PHP 7.4+), apply the vendor's free patch available for the JCE 2.7.x, 2.8.x, and 2.9.x branches. Note: the free patch fixes CVE-2026-48907 only and does not include the additional hardening of the latest release. Official source
  7. Administrators should immediately update affected Joomla components and extensions: Official source
  8. Hardening / Mitigation Official source
  9. Hardening / Mitigation Official source
  10. Restrict web server access to the /tmp/ directory and prevent PHP execution in temporary/upload directories at the web server level. Official source
  11. Restrict web server access to the /tmp/ directory and prevent PHP execution in temporary/upload directories at the web server level. Official source
  12. Preserve logs and suspicious files before deletion.Review Joomla administrator and Super User accounts.Remove unknown or unauthorised administrator accounts.Check for rogue JCE editor profiles.Search for suspicious PHP files in upload, image, media, cache, temporary, and extension-related directories.Review web server access logs for suspicious POST requests.Review recent file changes, especially around the suspected exploitation period.Rotate Joomla administrator passwords.Rotate database credentials, FTP/SFTP credentials, hosting control panel credentials, API keys, and other secrets accessible from the compromised server.Restore from a known-clean backup if compromise is confirmed and clean-up cannot be confidently completed. Official source
  13. Optionally deploy a web application firewall rule or intrusion detection system to detect and block suspicious file upload attempts, especially those with PHP extensions. Official source
  14. Review all JCE editor profiles and remove executable extensions from permitted upload types — including .php, .pht, .phtml, .shtml, .php5, .php7, .phar, .inc — even for authenticated users. Official source
  15. Restrict upload destinations to directories outside the web root where possible. Official source
  16. Restrict upload destinations to directories outside the web root where possible. Official source
  17. Disable PHP execution in upload, image, media, cache, and temporary directories.Restrict access to /administrator to trusted IP addresses or VPN users only.Enable Multi-Factor Authentication (MFA) for all Joomla administrator accounts.Remove unused Joomla extensions, templates, plugins, and components.Ensure Joomla core, templates, and all extensions are covered under patch management.Deploy Web Application Firewall (WAF) rules to detect and block suspicious requests targeting vulnerable Joomla endpoints.Monitor file integrity for unexpected changes in web-accessible directories.Maintain regular offline backups and test restoration procedures.Review server permissions to ensure the web server process has only the minimum required access. Official source
  18. Detection / Post-Compromise Forensics Official source
  19. Detection / Post-Compromise Forensics Official source
  20. Search web server access logs for suspicious POST requests to SP Page Builder upload paths (e.g. index.php?option=com_sppagebuilder&task=...). Official source
  21. Search web server access logs for suspicious POST requests to JCE upload paths (e.g. /index.php?option=com_jce&task=...). Official source
  22. Identify all Joomla websites under organisational ownership.Check whether JCE is installed.Update JCE to 2.9.99.7 or later, where available.Check whether SP Page Builder is installed.Update SP Page Builder to 6.6.2 or later.Review Joomla user lists for unknown Super Administrator accounts.Search for suspicious PHP files and web shells in upload, media, image, cache, and temporary directories.Review web logs for suspicious access to JCE and SP Page Builder endpoints. Official source
  23. Look for newly created or recently modified PHP files in Joomla media, upload, and /tmp/ directories. Official source
  24. Look for newly created or recently modified PHP files in Joomla media, upload, and /tmp/ directories. Official source
  25. Update Joomla CMS Core to the latest supported version.Update third-party Joomla extensions.Restrict administrator access using IP allowlisting or VPN.Enable MFA for all administrator accounts.Block PHP execution in upload and media folders. Official source
  26. Inspect upload and temporary directories for unexpected content (web shells). Official source
  27. Inspect upload and temporary directories for unexpected content (web shells). Official source
  28. Maintain an inventory of Joomla websites, versions, extensions, and system owners.Monitor vendor security advisories and CISA KEV updates.Conduct periodic vulnerability scanning.Review extension usage and remove unused or unsupported components.Monitor for suspicious file creation, privilege changes, and administrator account creation. Official source
  29. If compromise is confirmed, isolate the host, preserve evidence, and initiate incident response. Assume credential theft and lateral movement until proven otherwise. Official source
  30. Audit JCE editor profile configurations for unauthorised or unexpected profiles. Official source
  31. If compromise is confirmed, isolate the host, preserve evidence, and initiate incident response. Assume credential theft and lateral movement until proven otherwise. Official source

For everyone

  1. CyberSecurity Malaysia encourages users and administrators to review JCE Security updates and apply the necessary updates. Official source
  2. Generally, we advise users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied. Official source
  3. Patching alone is not sufficient if the website was already compromised. Administrators should: Official source
  4. Administrators should apply the following hardening measures: Official source
  5. Administrators should prioritise the following actions. Official source
  6. Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied. Official source

Which sources support it?

Evidence and official sources

  1. CISA Known Exploited VulnerabilitiesOfficial source
    JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2026-48908)

    JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

    Published 07 Jul 2026 · Retrieved 01 Aug 2026
  2. NACSA / NC4 Alerts and AdvisoriesOfficial source
    Critical Unauthenticated Remote Code Execution in SP Pagebuilder extension for Joomla — CVE-2026-48908

    NC4, (NACSA), has observed multiple attacks and incidents involving CVE-2026-48908, a critical improper access control vulnerability (CWE-284) in the SP Page Builder extension for Joomla. The vulnerability allows an unauthenticated remote attacker to abuse the custom icon upload function to upload and execute arbitrary PHP code, resulting in pre-authentication remote code execution on the affected web server.

    Published 29 Jun 2026 · Retrieved 01 Aug 2026
  3. NACSA / NC4 Alerts and AdvisoriesOfficial source
    Critical Unauthenticated Remote Code Execution in Joomla Content Editor (JCE) CVE-2026-48907

    NC4, (NACSA), has observed multiple attacks and incidents involving CVE-2026-48907, a critical improper access control vulnerability (CWE-284) in the Joomla Content Editor (JCE) extension for Joomla. The flaw allows an unauthenticated, remote attacker to create rogue editor profiles and abuse the profile import function to upload and execute arbitrary PHP code, resulting in full pre-authentication remote code execution (RCE) on the affected web server.

    Published 25 Jun 2026 · Retrieved 01 Aug 2026
  4. NIST National Vulnerability DatabaseOfficial source
    CVE-2026-48908: A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

    A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

    Published 20 Jun 2026 · Retrieved 30 Jul 2026
  5. NIST National Vulnerability DatabaseOfficial source
    CVE-2026-48907: A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.

    A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.

    Published 05 Jun 2026 · Retrieved 30 Jul 2026
  6. MyCERTOfficial source
    MA-1469.072026: MyCERT Advisory - Widget Factory Joomla Content Editor Improper Access Control Vulnerability

    Recently, the Joomla Content Editor (JCE) maintainers has released a security update in the JCE extension tracked as CVE-2026-48907, an unauthenticated remote code execution vulnerability.

    Published Just published · Retrieved 01 Aug 2026
  7. MyCERTOfficial source
    MA-1468.072026: MyCERT Alert - Critical Unauthenticated Remote Code Execution in Joomla Content Editor (JCE) Actively Exploited Against Malaysian Websites

    MyCERT is issuing this alert in response to active exploitation of a critical unauthenticated remote code execution vulnerability affecting the Joomla Content Editor (JCE) extension, tracked as CVE-2026-48907. The vulnerability is caused by improper access control in the JCE profile import functionality. A remote unauthenticated attacker may abuse this functionality to create unauthorised editor profiles and upload executable PHP content to the affected server, resulting in remote code execution under the privileges of the web server process. CVE-2026-48907 affects JCE versions prior to 2.9.99.5. The vulnerability has been rated critical, with NVD listing a CVSS v3.1 score of 9.8 and the Joomla CNA assigning a CVSS v4.0 score of 10.0. CISA added CVE-2026-48907 to its Known Exploited Vulnerabilities (KEV) catalog on 16 June 2026 due to evidence of active exploitation. NC4 has also issued advisory NC4-ALR-2026-000004 following observed attacks and incidents involving this vulnerability. MyCERT has observed that Malaysian websites using older or vulnerable Joomla/JCE installations are at heightened risk. Administrators are strongly advised to update immediately and perform compromise assessment, as patching alone will not remove web shells, rogue editor profiles, or other artefacts that may already have been deployed by attackers. The JCE vendor has also stated that updating closes the entry point but does not clean a site that was already compromised. In addition to CVE-2026-48907, MyCERT is also highlighting several Joomla and Joomla extension vulnerabilities that administrators should review as part of an urgent Joomla-wide security assessment and hardening exercise.

    Published Just published · Retrieved 01 Aug 2026