[KEV] CVE-2026-56290 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-56290 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-56290 is an improper access control vulnerability in Joomlack Page Builder that exposes the application to unauthenticated arbitrary file upload leading to remote code execution.

Technical Detail

The flaw exists in Joomlack Page Builder's file upload functionality, where access controls are insufficiently enforced, allowing an unauthenticated remote attacker to upload arbitrary files to the server without any credential requirement. An attacker can upload a malicious file, such as a web shell, and subsequently execute arbitrary code in the context of the web server process. Successful exploitation results in full remote code execution, potentially enabling complete host compromise, lateral movement, or persistent access.

Exploitation Status

CISA has confirmed active exploitation in the wild, with this vulnerability added to the Known Exploited Vulnerabilities catalog on July 7, 2026. The exploit is rated as operationally mature, meaning reliable exploitation code exists and is being actively used in real-world attacks rather than limited to proof-of-concept demonstrations. Organizations running Joomlack Page Builder should treat this as an actively targeted vulnerability requiring immediate remediation.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established for this vulnerability based on currently available data.

What To Do

Per CISA's Known Exploited Vulnerabilities catalog, organizations subject to BOD 22-01 must apply patches or implement mitigations by the deadline associated with the July 7, 2026 listing. Administrators should immediately update Joomlack Page Builder to the latest patched version as the primary remediation action. If patching cannot be completed immediately, consider disabling the Page Builder component or restricting access to file upload endpoints via web application firewall rules or network-layer controls until the patch is applied. Detection efforts should focus on monitoring web server logs for unexpected file creation events, newly written files with executable extensions in web-accessible directories, and anomalous outbound connections originating from the web server process. Review the server for signs of existing compromise, including web shells or unauthorized files, given that active exploitation has been confirmed prior to this date.