CISA KEV Alert: iCagenda and Balbooa Joomla Extensions — Active Exploitation Detection

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added critical security flaws affecting iCagenda and Balbooa Forms to its Known Exploited Vulnerabilities (KEV) catalog. For security practitioners, an addition to the KEV catalog is the definitive signal that a vulnerability is not just theoretical—it is being weaponized in active attacks right now.

Both iCagenda (an event management extension) and Balbooa Forms (a form creation tool) are widely used plugins for the Joomla CMS. Their presence in the KEV catalog indicates that threat actors are actively scanning for, exploiting, and compromising unpatched instances. If your organization runs Joomla, you are currently in the crosshairs. Immediate action is required to identify exposure, block exploitation attempts, and remediate the underlying flaws.

Technical Analysis

Affected Products

• Platform: Joomla Content Management System (CMS)
• Affected Components:
  • iCagenda: An open-source event management extension used to display calendars and manage events on Joomla sites.
  • Balbooa Forms: A commercial/commercial-grade form builder extension used for data collection and user interaction.

Vulnerability Mechanics

While specific CVE identifiers are not detailed in the immediate alert, the categorization into the KEV catalog suggests these are severe flaws, likely involving:

1. Input Validation Failures: Both plugins handle user input (events, form submissions). Flaws here often lead to SQL Injection (SQLi) or Remote Code Execution (RCE).
2. Authentication Bypass: Attackers may leverage logic flaws to gain administrative privileges without valid credentials.
3. File Upload Vulnerabilities: Form builders and event managers often handle file uploads. Improper validation could allow attackers to upload webshells (e.g., PHP shells) to achieve persistent access.

Exploitation Status

• Status: Confirmed Active Exploitation (CISA KEV).
• Threat Actor Behavior: Exploitation typically involves automated web scanners probing for the specific Joomla components (com_icagenda, com_balbooaforms). Once identified, actors inject malicious payloads via HTTP parameters to execute system commands or extract database credentials.

Detection & Response

Detecting exploitation attempts against these extensions requires monitoring web access logs and file system integrity. Since these are web application flaws, your primary telemetry will come from Web Application Firewalls (WAF), reverse proxies (Nginx/Apache logs), or host-based monitoring.

SIGMA Rules

The following Sigma rules target suspicious URI patterns associated with these components. They flag access to known administrative or parameter endpoints that are commonly abused in exploit attempts.

---
title: Potential iCagenda Joomla Component Exploitation
id: 8a1b2c3d-4e5f-6789-0abc-1def23456789
status: experimental
description: Detects potential exploitation attempts against the iCagenda Joomla component based on suspicious URI parameters and access patterns.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/04/14
tags:
  - attack.initial_access
  - attack.web_shells
  - attack.t1190
logsource:
  category: web
  product: apache
detection:
  selection_uri:
    c|contains: '/index.php?option=com_icagenda'
  selection_suspicious:
    c|contains:
      - 'view='
      - 'layout='
      - 'task='
  selection_keywords:
    c|contains:
      - 'SELECT'
      - 'union'
      - 'eval('
      - 'base64_decode'
  condition: selection_uri and selection_suspicious and selection_keywords
falsepositives:
  - Legitimate administrative usage of the component (rare for automated keywords)
level: high
---
title: Potential Balbooa Forms Joomla Component Exploitation
id: 9b2c3d4e-5f6a-7890-1bcd-2efg34567890
status: experimental
description: Detects potential exploitation attempts against the Balbooa Forms Joomla component, looking for direct access to controller files or suspicious parameters.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/04/14
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: web
  product: nginx
detection:
  selection_uri:
    c|contains:
      - 'option=com_balbooaforms'
      - 'controller=com_balbooaforms'
  selection_method:
    http_method|contains:
      - 'POST'
  selection_payload:
    c|contains:
      - 'jform'
      - 'field'
      - '../'
  condition: selection_uri and selection_method and selection_payload
falsepositives:
  - Legitimate form submissions (verify user-agent and source IP)
level: medium

KQL (Microsoft Sentinel / Defender)

This query hunts for web requests targeting these specific Joomla components across your network perimeter logs (Syslog/CEF).

// Hunt for suspicious iCagenda and Balbooa Forms activity
CommonSecurityLog
| where RequestURL has "index.php" 
| where RequestURL has_any ("com_icagenda", "com_balbooaforms") 
| project TimeGenerated, DeviceName, RequestURL, SourceIP, DestinationPort, RequestMethod 
| where RequestMethod != "GET" or RequestURL has_any ("select", "union", "eval", "script", "/etc/passwd")
| summarize count() by SourceIP, RequestURL, bin(TimeGenerated, 1h)
| where count_ > 5 // High volume indicates scanning
| order by count_ desc

Velociraptor VQL

Endpoint hunting is critical to ensure the vulnerable components are present on the server and to check for potential webshells that may have already been dropped.

// Hunt for Joomla extensions and recent modifications
SELECT 
  FullPath, 
  Mtime, 
  Size, 
  Mode
FROM glob(globs="/**/components/com_icagenda/*")
WHERE Mtime > now() - 7d

UNION ALL

SELECT 
  FullPath, 
  Mtime, 
  Size, 
  Mode
FROM glob(globs="/**/components/com_balbooaforms/*")
WHERE Mtime > now() - 7d

Remediation Script (Bash)

Use this Bash script to scan your Joomla installation directories for these components and identify their version status from the XML manifest files. This aids in asset discovery prior to patching.

#!/bin/bash

# Scan for vulnerable Joomla components
# Usage: ./scan_joomla.sh /path/to/web/root

WEB_ROOT="$1"

if [ -z "$WEB_ROOT" ]; then
  echo "Usage: $0 <path_to_joomla_root>"
  exit 1
fi

echo "Scanning for iCagenda..."
find "$WEB_ROOT" -type f -name "icagenda.xml" -exec echo "Found iCagenda manifest: {}" \; \n

echo "Scanning for Balbooa Forms..."
find "$WEB_ROOT" -type f -name "balbooaforms.xml" -exec echo "Found Balbooa Forms manifest: {}" \; \n

echo "Checking for recently modified PHP files in extension directories..."
find "$WEB_ROOT/components" -type d \( -name "com_icagenda" -o -name "com_balbooaforms" \) -exec find {} -name "*.php" -mtime -7 \;

echo "Scan complete. Please verify versions against vendor advisories."

Remediation

1. Immediate Patching: Apply the latest security updates provided by the vendors for iCagenda and Balbooa Forms immediately. Discontinuation of these extensions may be necessary if no patch is available for your version.
2. Vendor Advisory Review: Consult the official security advisories from iCagenda and Balbooa to determine the specific safe versions.
3. CISA Directive (BOD 22-01): Federal Civilian Executive Branch (FCEB) agencies have a mandatory deadline to patch these vulnerabilities by the date specified in the KEV catalog entry. Private sector organizations should treat this deadline as a target for their own remediation to minimize risk.
4. Disable Unnecessary Extensions: If these extensions are not actively required for business operations, disable or uninstall them from the Joomla extension manager immediately. Reducing the attack surface is the most effective defense.
5. Web Application Firewall (WAF): Ensure your WAF signatures are up to date to block known exploit patterns for these specific Joomla components.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub