[KEV] CVE-2026-48907 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-48907 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-48907 is an improper access control vulnerability in Widget Factory's Joomla Content Editor, a third-party content editing extension for the Joomla CMS platform.

Technical Detail

The flaw exists in the editor profile creation functionality, which fails to enforce authentication checks, allowing unauthenticated users to create new editor profiles. Through this mechanism, an attacker can upload and execute arbitrary PHP code on the underlying server, resulting in unauthenticated remote code execution (RCE). Successful exploitation grants the attacker the ability to run arbitrary commands in the context of the web server process, potentially leading to full server compromise, data exfiltration, or deployment of additional payloads.

Exploitation Status

CISA has confirmed active exploitation in the wild, with this vulnerability added to the Known Exploited Vulnerabilities (KEV) catalog on June 16, 2026. The exploit maturity is rated Operational, meaning functional exploit code exists and is being actively used in attacks rather than existing only as a proof-of-concept. Organizations running affected versions of Joomla Content Editor should treat this as an immediate priority.

Who Is Targeting This

No confirmed (ATTAX-verified) threat actor attribution has been established at this time. Reported (research-inferred) actors associated with this vulnerability at medium confidence include DEEPPANDA, CARBANAK, LOTUSBLOSSOM, AXIOM, and MOONSTONESLEET. The origin and motivation for each of these actors in relation to this specific vulnerability remain unknown. These attributions should be treated as investigative leads rather than confirmed findings pending further corroboration.

What To Do

Per CISA's Known Exploited Vulnerabilities catalog, organizations subject to BOD 22-01 must apply patches or implement mitigations by the deadline associated with the June 16, 2026 KEV listing. Administrators should immediately update Joomla Content Editor to the latest patched version provided by Widget Factory. If a patch is not yet available or cannot be applied immediately, the recommended interim measure is to disable or remove the Joomla Content Editor extension entirely until remediation is possible. Web server logs should be reviewed for anomalous POST requests to editor profile creation endpoints, unexpected PHP file uploads, and any newly created files in web-accessible directories. Outbound connections from the web server process to unfamiliar hosts may indicate post-exploitation activity and should be investigated promptly.