CVE-2026-48907: JCE editor for Joomla allows unauthenticated profile creation and PHP upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 4.0 score of 10.0, unauthenticated remote code execution, KEV listing and very high EPSS probability make this an urgent patch-first issue.

What it is

The JCE editor extension for Joomla permits unauthenticated users to create new editor profiles, which leads to upload and execution of PHP code. This is an improper access control flaw (CWE-284) rated CVSS 4.0 10.0 CRITICAL, and it is listed in CISA KEV, so it is being exploited in the wild.

Impact

An unauthenticated attacker can upload and execute arbitrary PHP on the Joomla server, giving full control of the site and likely the underlying host. That enables data theft, defacement, persistence and use of the server as a foothold.

Attack surface

Reachable over the network with no authentication and no user interaction (CVSS 4.0 vector AV:N/PR:N/UI:N). Any internet-exposed Joomla site running the affected JCE extension is a candidate target.

Exploitation

Listed in CISA KEV with a due date of 2026-06-19, and EPSS 30-day probability is 0.781 (99.55th percentile), indicating active exploitation. No ransomware campaign use is documented in the record.

What to do

• Apply the vendor security update for JCE as described in the vendor advisory; if the site cannot be patched, follow the vendor's free patch guidance for older sites.
• If no fix can be applied, take the Joomla site offline or block access to the JCE component endpoints until patched.
• Restrict or remove the JCE editor extension where it is not required.
• Review Joomla and JCE configuration for unauthorized editor profiles and remove any that are not expected.
• Follow CISA BOD 26-04 guidance and the KEV required action, including forensics triage for internet-exposed assets.

Detection

• Audit JCE editor profiles for entries created outside normal administrative workflows, especially recent or unexpected profiles.
• Monitor web server and Joomla logs for unauthenticated requests to JCE component endpoints that create profiles or upload files.
• Alert on newly written PHP files in Joomla web-accessible directories, particularly upload or media paths.
• Hunt for unexpected PHP execution or outbound connections from the Joomla host that follow JCE-related requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.