[KEV] CVE-2026-56290 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-56290 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-56290 is an improper access control vulnerability in Joomlack Page Builder that exposes the application to unauthenticated arbitrary file upload and subsequent remote code execution.

Technical Detail

The flaw stems from missing or insufficient access controls on a file upload endpoint within Joomlack Page Builder, allowing an unauthenticated remote attacker to upload arbitrary files, including server-side executable code, without any valid credentials. Once a malicious file is uploaded and placed in a web-accessible directory, an attacker can trigger execution to achieve full remote code execution on the underlying server. The impact is critical in practice: successful exploitation grants the attacker arbitrary command execution under the web server process context, enabling further compromise of the host and potentially the broader environment.

Exploitation Status

CISA has confirmed active exploitation in the wild, having added this vulnerability to the Known Exploited Vulnerabilities catalog on July 7, 2026. The exploit maturity is rated Operational, meaning functional exploit code exists and is being used in real-world attacks, not merely demonstrated in a controlled research setting. Organizations running Joomlack Page Builder should treat this as an actively targeted vulnerability requiring immediate action.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established for this vulnerability. Given the unauthenticated nature of the exploit and its operational maturity, opportunistic actors conducting broad internet scanning are a plausible threat profile, but no named groups or campaigns have been linked to exploitation of this CVE.

What To Do

Per CISA's Known Exploited Vulnerabilities catalog directive, federal agencies are required to apply patches or mitigations by the deadline associated with the July 7, 2026 listing. All organizations running Joomlack Page Builder should apply any available vendor-supplied patch immediately and treat this as a priority remediation. If a patch is not yet available, restrict access to the affected file upload functionality at the network or application layer, enforce authentication controls on all upload endpoints, and consider temporarily disabling the Page Builder component until a fix is applied. Detection efforts should focus on monitoring web server logs for unexpected file uploads, particularly to directories with execute permissions, and for anomalous POST requests to upload-related endpoints. Scan web-accessible directories for newly created script files with extensions such as .php, .jsp, or .asp that were not placed there through normal deployment processes.