Loading story…
CISA added CVE-2026-56291 to its Known Exploited Vulnerabilities catalog after the flaw was disclosed as an unauthenticated arbitrary file upload bug in the Balbooa Forms extension for Joomla. The vulnerability affects versions 1.0 through 2.4.0 and allows attackers to upload executable files, leading to full remote code execution. The issue is tracked as CWE-434 and was assigned a high-severity CVSS v4 vector reflecting network-based exploitation, low attack complexity, and high impact across confidentiality, integrity, and availability.
The same KEV update also added CVE-2026-48939 in iCagenda, another unrestricted file upload flaw that can enable arbitrary file upload and PHP code execution. CISA's catalog update raised the total KEV count from 1,635 to 1,637 entries and set a 2026-07-13 remediation deadline for both vulnerabilities, while noting that known ransomware use is currently unknown.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-10, CISA updated its Known Exploited Vulnerabilities catalog and added CVE-2026-56291 in Balbooa Forms as a newly cataloged exploited vulnerability. CISA assigned a remediation due date of 2026-07-13 for the entry.
A new CVE entry, CVE-2026-56291, was received by security@joomla.org on 2026-07-09 for an unauthenticated arbitrary file upload vulnerability in Balbooa Forms versions 1.0 through 2.4.0. The flaw can allow upload of executable files and lead to full remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **five vulnerabilities** to its **Known Exploited Vulnerabilities (KEV) Catalog** based on evidence of **active exploitation**, reinforcing that these issues are being used as real-world attack vectors and should be prioritized for remediation. The newly listed CVEs are **CVE-2018-14634** (Linux kernel integer overflow / local privilege escalation), **CVE-2025-52691** (SmarterTools *SmarterMail* unrestricted file upload enabling RCE), **CVE-2026-21509** (Microsoft Office security feature bypass), **CVE-2026-23760** (SmarterTools *SmarterMail* authentication bypass via alternate path/channel), and **CVE-2026-24061** (GNU *InetUtils* argument injection). CISA reiterated that these vulnerability classes are frequently leveraged by threat actors and pose material risk to enterprise environments. Under **BOD 22-01**, U.S. Federal Civilian Executive Branch (FCEB) agencies are required to remediate KEV-listed vulnerabilities by CISA-specified due dates, and CISA urged all organizations to treat KEV entries as high-priority items in vulnerability management. Additional technical context highlighted that **CVE-2025-52691** can enable unauthenticated arbitrary file upload leading to **remote code execution** (noted as **CVSS 10.0** in the reporting) and that **CVE-2018-14634**, while older, remains relevant where legacy Linux kernels persist—underscoring that KEV additions can include long-standing flaws when exploitation is observed in the wild.
Jun 29, 2026
CISA updated its *Known Exploited Vulnerabilities (KEV) Catalog* to reflect **active exploitation** of a previously patched **BeyondTrust** remote code execution flaw, **CVE-2026-1731** (CVSS 9.9), which has now been tied to **ransomware activity**. Reporting also cited third-party telemetry indicating an increase in exploitation attempts, and emphasized that because BeyondTrust commonly sits in **identity/privileged access** paths, successful RCE can rapidly translate into broad enterprise compromise; recommended mitigations included immediate patching and, if patching is not immediately possible, taking the affected portal offline or tightly restricting access. Separately, CISA also announced the addition of two **Roundcube Webmail** vulnerabilities to the KEV Catalog based on evidence of active exploitation: **CVE-2025-49113** (deserialization of untrusted data) and **CVE-2025-68461** (cross-site scripting). CISA reiterated that under **BOD 22-01**, U.S. Federal Civilian Executive Branch agencies must remediate KEV-listed issues by mandated deadlines, and urged all organizations to prioritize remediation of KEV entries as a high-signal indicator of real-world exploitation risk.
Jun 29, 2026
CISA added two **Roundcube Webmail** vulnerabilities to its **Known Exploited Vulnerabilities (KEV)** catalog, citing evidence of **active exploitation**: **CVE-2025-49113** (CVSS 9.9), a deserialization issue enabling **authenticated remote code execution** due to improper validation of the `_from` URL parameter in `program/actions/settings/upload.php`, and **CVE-2025-68461** (CVSS 7.2), an **XSS** flaw involving the `animate` tag in an SVG document. CISA directed U.S. Federal Civilian Executive Branch (FCEB) agencies to remediate by **2026-03-13**, and advised applying vendor mitigations per guidance (or discontinuing use if mitigations are unavailable). The KEV repository updates for **2026-02-20** reflect both Roundcube entries, including mappings to **CWE-502** (deserialization) and **CWE-79** (XSS) and links to Roundcube advisories/releases. Reporting also noted that researchers observed rapid attacker uptake of CVE-2025-49113 after disclosure, including claims that attackers quickly “diffed and weaponized” the bug and that exploit access was offered for sale shortly after. Separate reporting about **BeyondTrust Remote Support/Privileged Remote Access** (**CVE-2026-1731**) describes a different KEV addition and is not part of the Roundcube event.
Jun 29, 2026