CVE-2026-56290 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-06-29

Added to CISA KEV: 2026-07-07 8 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review web server logs for suspicious file uploads (especially .php files), check web-accessible directories for unauthorized files/webshells, and verify system integrity.
IMMEDIATELY update the Page Builder CK extension to version 3.6.0 or later. If patching is not immediately possible, disable or uninstall the extension.
Deploy WAF rules to block malicious file upload patterns as a temporary mitigation, and scan the web root for webshells/backdoors given the likelihood of prior compromise.
Patch Priority: EMERGENCY / P0 — CISA KEV-listed, unauthenticated RCE with active mass exploitation. Remediate within CISA-mandated timelines (or immediately for private-sector orgs).

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-56290 is a critical security vulnerability affecting the Page Builder CK extension for the Joomla content management system. The flaw stems from an unrestricted arbitrary file upload mechanism that allows unauthenticated remote attackers to upload executable files (such as PHP scripts) to the web server. Because the application fails to properly validate file types, this vulnerability enables full remote code execution (RCE) on the host, making it an extremely severe threat to the integrity and confidentiality of any compromised Joomla installation.

Exploitation

Active Exploitation: The vulnerability is actively exploited in the wild and was officially added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerability (KEV) catalog on July 7, 2026.
Threat Actors: While specific advanced persistent threat (APT) groups have not been explicitly named in public reports as the sole actors, it is being targeted by automated mass-exploitation tools and various malicious actors.
Proof-of-Concept/Exploits: Public proof-of-concept (PoC) code and automated exploitation scripts (such as those found on platforms like GitHub) are widely available.
Prerequisites:

* Network: Exploitation is performed remotely over the network. * Authentication: No authentication is required; the vulnerability is accessible to unauthenticated attackers. * User Interaction: No user interaction is required to trigger the exploit.

Affected Products & Patches

Affected Versions: All versions of the Page Builder CK extension for Joomla prior to 3.6.0 are affected.
Patch Availability: A patch was released in version 3.6.0 of the Page Builder CK extension. Users are strongly advised to update to this version or higher immediately.
Mitigations/Workarounds: If an immediate update is not possible, organizations should disable or uninstall the Page Builder CK extension. Web Application Firewalls (WAFs) may provide temporary protection by blocking common file upload patterns, but patching remains the only reliable remediation.

Impact

Access/Capability: Successful exploitation results in full remote code execution, granting the attacker the ability to run arbitrary commands with the privileges of the web server process.
Business Risk: For internet-facing deployments, this vulnerability presents an existential risk, as it allows attackers to completely compromise the web server. This can lead to full data breaches, the installation of backdoors or ransomware, complete website defacement, and the lateral movement of attackers into the internal corporate network.