Intel

CVE-2026-48907

jce: Improper Access Control (CVE-2026-48907)

criticalKEV: actively exploitedPoCEPSS 78%

Description

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.

Source: CVELISTV5BSI_CSAFBSICISA_KEVNVD

Response & Mitigation

Why act now?

Prioritisation rationale

With a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N) and an EPSS percentile of 99.5 %, this vulnerability is a prime target for automated mass exploitation — no credentials, no user interaction, and direct remote code execution on the web server. For NIS2-regulated organisations running publicly accessible Joomla instances — particularly in public administration, healthcare, and critical infrastructure — exposure must be treated as critical and remediation cannot wait for a scheduled maintenance window. Even intranet-facing Joomla deployments with JCE installed are at risk if the management interface is reachable from a compromised internal host. Although CISA has not flagged known ransomware campaign use at time of publication, webshell deployment is a well-established initial-access technique that routinely precedes data exfiltration and ransomware staging, so the absence of that flag should not reduce urgency.

Runbook · Step 1

Immediate response (0-24 h)

  • Disable or uninstall the JCE extension immediately: In the Joomla backend under Extensions → Manage, set the "JCE" component (Widget Factory Joomla Content Editor) to "Disabled" or remove it entirely. All versions ≤ 2.9.99.5 are affected — check the vendor advisory from widgetfactorylimited for the patched release version before re-enabling.
  • Scan all upload directories for newly created PHP files: Check /images/, /media/, /tmp/, and JCE-specific paths such as /plugins/editors/jce/ for .php, .php5, and .phtml files (find /var/www -name "*.php" -newer /var/www/index.php).
  • Preserve and quarantine any discovered webshells: Do not delete suspicious files — move them outside the webroot to a quarantine directory and preserve them for forensic analysis.
  • Block unauthenticated access to JCE paths at the web layer: Deny HTTP requests to /index.php?option=com_jce and /plugins/editors/jce/ for unauthenticated sources via WAF, .htaccess, or nginx configuration.
  • Rotate all Joomla administrator credentials and API tokens: Unauthenticated access to the editor profile creation endpoint may have allowed full backend compromise — reset all privileged credentials immediately.
  • Validate system integrity: Compare Joomla core files against known-good hashes using Joomla's built-in integrity checker or diff against a clean installation; query the database for unknown super-administrator accounts (SELECT * FROM #__users WHERE usertype='Super Administrator').

Runbook · Step 2

Mitigation layers

  • Network segmentation: Ensure the web server DMZ is isolated from internal networks; apply strict egress filtering on the web server host to block outbound C2 communication following a potential webshell deployment.
  • Disable PHP execution in upload directories: Configure the web server to deny PHP execution in all upload paths (/images/, /media/, /tmp/):
    • Apache: php_flag engine off in .htaccess or a <Directory> block
    • nginx: location ~* \.php$ { deny all; } scoped to upload directories
  • WAF rule: Block POST requests matching option=com_jce where the body contains PHP code patterns (<?php, eval(, base64_decode(). Deploy a ModSecurity rule or equivalent IPS signature targeting this combination.
  • Least-privilege for the web server process: Ensure PHP-FPM/Apache worker processes have no write access to directories where PHP execution is permitted — enforce filesystem permissions following the principle of least privilege.
  • Harden Joomla configuration: Set $config->tmp_path and $config->log_path outside the webroot; set configuration.php to chmod 444; restrict the Joomla admin panel (/administrator/) to known IP ranges.
  • File Integrity Monitoring (FIM): Enable FIM (AIDE, Wazuh, or equivalent) on the webroot to generate immediate alerts on newly created or modified PHP files.

Runbook · Step 3

Detection rules

  • Web server access log — unauthenticated POST requests to JCE endpoints: Flag POST requests matching option=com_jce and task=.*profile returning HTTP 200 without a valid Joomla session cookie — SPL: index=web_logs method=POST uri="*com_jce*" status=200 | where isnull(cookie) OR cookie!="*joomla_user_state=logged_in*"
  • Filesystem — PHP file creation in upload directories (auditd/Sysmon):
    • Linux auditd: -w /var/www/html/images -p wa -k jce_upload_watch; alert on type=CREATE events where the filename ends in .php
    • Sysmon EID 11 (FileCreate): TargetFilename contains \images\ or \media\ and ends with .php
  • EDR process ancestry — webshell execution: Alert on process chains where apache2 or php-fpm spawns sh, bash, curl, wget, or whoami; Sigma shape: ParentImage: '*php-fpm*' AND Image: ('*/sh' OR '*/bash' OR '*/curl')
  • Network telemetry (Zeek/Suricata): Correlate outbound connections from the web server host to unknown external IPs on unusual ports (4444, 1337, 8080) with preceding POST requests to com_jce — join http.log and conn.log on id.orig_h.
  • Database monitoring — unexpected user or profile inserts: Alert on INSERT INTO #__users or INSERT INTO #__user_profiles events that have no corresponding administrator session in the Joomla audit log.

Metrics

Severity
critical
Priority score
239.74
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
10.0
Source: nvd-v4
CVSS v3
9.8
CVSS v4
10.0
EPSS percentile
99.6 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
78.1 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2026-06-05 07:31 UTC
CWE
CWE-284

Weakness classes (CWE)

  • CWE-284Pillar

    Improper Access Control

    The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Translated2026-07-23 07:10 UTC· nvd@nist.gov
    • Translation: Title: extensión Joomla Content Editor (JCE) para Joomla, Description: Una vulnerabilidad en la extensión del editor JCE para Joomla permite la creación de nuevos perfiles de editor para usuarios no autenticados, lo que en última instancia resulta en la carga y ejecución de código PHP.
  2. CVE CISA KEV Update2026-06-17 16:00 UTC· 9119a7d8-5eab-497f-8521-727c672e3725
    • Date Added: 2026-06-16
    • Due Date: 2026-06-16
    • Required Action: 2026-06-16
    • Vulnerability Name: 2026-06-16

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • widgetfactorylimited

    jce2.9.99.5

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked advisories

IDCVE-2026-48907