CISA Adds Vulnerabilities in the Joomla iCagenda and Balbooa Extensions to Its Exploited Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities affecting the iCagenda and Balbooa Forms extensions for the Joomla content management system to its catalog of known exploited vulnerabilities (KEV).

The decision followed reports that both vulnerabilities were being exploited by threat actors as zero-day attacks — that is, before official patches were available.

Maximum risk score

Both vulnerabilities received the highest possible score on the CVSS scale — 10.0 points, indicating a critical level of severity.

One of the vulnerabilities, assigned the identifier CVE-2026-48939, affects the iCagenda extension. Details about the nature of the second vulnerability, related to Balbooa Forms, are not disclosed in the available account.

What inclusion in the KEV catalog means

Adding a vulnerability to the KEV catalog implies that it is already being used by attackers in real-world attacks. For U.S. federal agencies, this generally means the issue must be remediated within a set timeframe.

For owners of Joomla sites that use the iCagenda and Balbooa Forms extensions, the fact that the vulnerabilities have made it into the catalog serves as a signal to immediately check the versions in use and install any available security updates.

Joomla remains one of the most widely used content management systems, and third-party extensions frequently become an entry point for attacks on sites built on this platform.

Source: The Hacker News