CVE-2026-48939Critical· 9.8▾ Hadal⚠ Exploited in the wildPoC available

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)

Depth score83/ 100 · Severe

impact 53.9 · likelihood 4 · exploitation 25

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Jun 20, 2026

Updated

Jul 3, 2026

CVSS

9.8

Vendor

joomlic

Product

icagenda

CWE

CWE-284, CWE-434

Depth score

83 · Severe

EPSS

20% · p97

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit availability

Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.

checked 2026-09-21

GitHub PoCs

3 public repositories

Nuclei

CVE-2026-48939.yaml ↗

EPSS history

Exploit-prediction probability, daily snapshots since Jul 4.

0.5% → 20%▲ 20%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

7 events · 81 days

Jun 20, 2026Published
Disclosed via NVD
Jul 3, 2026Record revised
Last analysed / modified upstream
Jul 4, 2026EPSS first tracked
0.5%
Jul 10, 2026Added to CISA KEV
Federal remediation due Jul 13, 2026
Jul 10, 2026Exploitation in the wild observed
Aug 7, 2026EPSS peak
0.5% → 83%
Sep 8, 2026Public exploit observed
3 GitHub repos · Nuclei ×1

joomlic CWE-284 CWE-434 #nvd #kev #in-the-wild #exploit-available

CISA KEVKnown Exploited Vulnerability

Added to the CISA catalog on Jul 10, 2026. Federal remediation due Jul 13, 2026. View catalog ↗

Affected

icagenda >= 3.2.1, < 3.9.15
icagenda >= 4.0.0, < 4.0.8

Patched in

icagenda 4.0.8

Full technical detail▾

Overview

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

Affected

icagenda >= 3.2.1, < 3.9.15
icagenda >= 4.0.0, < 4.0.8

Remediation

Upgrade past the affected range:

icagenda 4.0.8

References

Change history

Field changes observed since this record was first indexed.

Sep 8, 2026Public exploit / PoC published
Sep 8, 2026Public exploit flag cleared
Sep 8, 2026Public exploit / PoC published
Sep 8, 2026Public exploit flag cleared
Sep 8, 2026Public exploit / PoC published
Aug 24, 2026EPSS 83% → 20%
Aug 7, 2026EPSS 24% → 83%
Jul 24, 2026EPSS 2% → 24%
Jul 10, 2026Exploitation in the wild observed
Jul 10, 2026Added to CISA KEV

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#kev#in-the-wild#exploit-available

← Back to feed

CVE-2026-48939Critical· 9.8▾ Hadal⚠ Exploited in the wildPoC available

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)

Depth score83/ 100 · Severe

impact 53.9 · likelihood 4 · exploitation 25

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Jun 20, 2026

Updated

Jul 3, 2026

CVSS

9.8

Vendor

joomlic

Product

icagenda

CWE

CWE-284, CWE-434

Depth score

83 · Severe

EPSS

20% · p97

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit availability

Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.

checked 2026-09-21

GitHub PoCs

3 public repositories

Nuclei

CVE-2026-48939.yaml ↗

EPSS history

Exploit-prediction probability, daily snapshots since Jul 4.

0.5% → 20%▲ 20%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

7 events · 81 days

Jun 20, 2026Published
Disclosed via NVD
Jul 3, 2026Record revised
Last analysed / modified upstream
Jul 4, 2026EPSS first tracked
0.5%
Jul 10, 2026Added to CISA KEV
Federal remediation due Jul 13, 2026
Jul 10, 2026Exploitation in the wild observed
Aug 7, 2026EPSS peak
0.5% → 83%
Sep 8, 2026Public exploit observed
3 GitHub repos · Nuclei ×1

joomlic CWE-284 CWE-434 #nvd #kev #in-the-wild #exploit-available

CISA KEVKnown Exploited Vulnerability

Added to the CISA catalog on Jul 10, 2026. Federal remediation due Jul 13, 2026. View catalog ↗

Affected

icagenda >= 3.2.1, < 3.9.15
icagenda >= 4.0.0, < 4.0.8

Patched in

icagenda 4.0.8

Full technical detail▾

Overview

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

Affected

icagenda >= 3.2.1, < 3.9.15
icagenda >= 4.0.0, < 4.0.8

Remediation

Upgrade past the affected range:

icagenda 4.0.8

References

Change history

Field changes observed since this record was first indexed.

Sep 8, 2026Public exploit / PoC published
Sep 8, 2026Public exploit flag cleared
Sep 8, 2026Public exploit / PoC published
Sep 8, 2026Public exploit flag cleared
Sep 8, 2026Public exploit / PoC published
Aug 24, 2026EPSS 83% → 20%
Aug 7, 2026EPSS 24% → 83%
Jul 24, 2026EPSS 2% → 24%
Jul 10, 2026Exploitation in the wild observed
Jul 10, 2026Added to CISA KEV

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#kev#in-the-wild#exploit-available