Joomla Admins: Patch Immediately - iCagenda & Balbooa Zero-Days in KEV

Just saw the update from CISA adding two Joomla extensions to the Known Exploited Vulnerabilities (KEV) catalog. If you manage Joomla instances, specifically using iCagenda or Balbooa Forms, stop what you're doing and patch.

Both flaws are rated CVSS 10.0, which means the bar for exploitation is non-existent.

The Vulnerabilities

• CVE-2026-48939 (iCagenda): An unauthenticated remote code execution vulnerability. The report indicates attackers are actively abusing this to drop web shells.
• Balbooa Forms: A separate flaw (likely file upload or auth bypass) also being leveraged in the wild.

Since these are zero-days in the KEV, we have to assume active scanning is underway.

Hunting

Check your access logs for POST requests to these components. You can use this snippet to grep your Apache/Nginx logs for suspicious activity:

grep -E "(com_icagenda|com_balbooaforms)" /var/log/apache2/access.log | grep POST


If you find hits, verify the file system integrity immediately. Look for recently created PHP files in the extension directories:

find /path/to/joomla/components -name "*.php" -mtime -1


Is anyone else seeing an uptick in automated scanning against these specific components today, or is it just isolated to a few campaigns?