Joomla JCE Extension Unauthenticated Remote Code Execution (CVE-2026-48907)

The CVE record says a flaw in the JCE editor extension for Joomla "allows the creation of new editor profiles for unauthenticated users." The result, it says, is PHP code upload and execution. The Joomla CNA rates it CVSS 4.0 10.0 Critical, and NVD adds a CVSS 3.1 score of 9.8. CISA lists it in KEV as an improper access control flaw (CWE-284).

JCE is a rich text editor that site owners install in Joomla. An editor profile controls what a group of users may do in that editor, including which file types they may upload. Letting an anonymous visitor create a profile hands that visitor the upload settings.

How the Attack Works

The vendor's advisory says the attack gets an editor profile onto the site that permits uploading executable files, then uses that profile to upload one. The known entry point is an unauthenticated request to the profile import task, index.php?option=com_jce&task=profiles.import. The advisory links to an independent analysis at mysites.guru for a fuller technical breakdown.

The vendor also says attacks are automated, so a site with no public registration is not safe. The JCE changelog describes the fix in 2.9.99.5 as "Insufficient access controls permitted unauthenticated users to upload editor profiles."

Signs a Site Was Reached

The vendor lists these checks. Look for editor profiles you did not create, often with generated names near the top of the list, or profiles that permit script uploads. Check access logs for unauthenticated requests to the profile import task, and ask the host early because logs rotate.

Then inspect the images, media and tmp folders for PHP files or names that contain "php", such as foo.php.xml. The images folder is the default upload location when a profile sets no path. The earliest log match shows when the site was first reached, which helps you choose a clean backup. Our web shell glossary entry describes what an uploaded script is used for.

Exploitation Signals for CVE-2026-48907

These are the public signals we checked on 4 November 2026. Each row names its source and date.

The repository descriptions are the authors' own claims, and we did not run any code. Some of the Blackhole posts bundle this CVE with CVE-2026-48908, a flaw in another Joomla extension, SP Page Builder.

A remote code execution flaw on a content management system is often a first step toward a wider intrusion. See our remote code execution glossary entry and the CMS and developer tool vulnerability archive for related cases.

The CVE record lists JCE versions 1.0.0 to 2.9.99.4 as affected, and NVD matches every version before 2.9.99.5. The vendor says its patch covers all earlier versions. The table below follows the vendor advisory and the JCE changelog.

The free patch package comes with limits that the vendor lists. It carries none of the hardening from 2.9.99.6 onward, it is provided as is, and it does not clean a compromised site. The vendor calls it a stopgap and advises moving to a supported PHP and Joomla platform.

If a site can neither update nor use the patch, the vendor recommends uninstalling JCE. Updating closes the entry point but does not remove an existing compromise. The latest changelog entry we read is 2.9.99.12 of 7 October 2026.

The changelog also lists a separate fix in 2.9.99.10, CVE-2026-65891, which needs an authenticated, privileged user. Do not confuse the two. Our patch management glossary entry and vulnerability management guide cover how to track extension updates across many sites.