CISA flags Joomla iCagenda and Balbooa Forms zero‑day file‑upload flaws
CISA added CVE‑2026‑48939 for iCagenda and CVE‑2026‑56291 for Balbooa Forms to its Known Exploited Vulnerabilities catalog after confirming active zero‑day attacks that let attackers upload arbitrary files and achieve remote code execution. Federal agencies must patch by July 13 2026, and any Joomla site using these extensions faces immediate compromise risk.